cvelistv5 - CVE-2002-1148

CVE-2002-1148 (GCVE-0-2002-1148)

Vulnerability from cvelistv5

Published

2004-09-01 04:00

Modified

2024-08-08 03:12

Severity ?

CWE

Summary

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

References

URL

	Vendor	Product	Version
	n/a	n/a	Version: n/a

rhsa-2002:218

Vulnerability from csaf_redhat

Published

2002-11-05 00:00

Modified

2025-10-09 12:32

Summary

Red Hat Security Advisory: tomcat security update for Stronghold

Notes

Topic

Updated tomcat packages are now available for Stronghold on Red Hat Linux Advanced Server to close a JSP source code exposure vulnerability.

Details

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. A source code exposure vulnerability has been found that affects Tomcat versions 4.0.0 through 4.0.4 and 4.1.0 through 4.1.10. Using a carefully crafted request, a remote attacker can read the source code of any deployed JSP file. Stronghold for Red Hat Linux Advanced Server shipped with Tomcat version 4.0.3 and is therefore susceptible to this vulnerability. All users are advised to upgrade to these errata packages containing Tomcat version 4.0.5 which is not vulnerable to these issues.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated tomcat packages are now available for Stronghold on Red Hat Linux\nAdvanced Server to close a JSP source code exposure vulnerability.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Tomcat is the servlet container that is used in the official Reference\nImplementation for the Java Servlet and JavaServer Pages technologies.  A\nsource code exposure vulnerability has been found that affects  Tomcat\nversions 4.0.0 through 4.0.4 and 4.1.0 through 4.1.10.\n\nUsing a carefully crafted request, a remote attacker can read the source\ncode of any deployed JSP file.\n\nStronghold for Red Hat Linux Advanced Server shipped with Tomcat version\n4.0.3 and is therefore susceptible to this vulnerability.\n\nAll users are advised to upgrade to these errata packages containing\nTomcat version 4.0.5 which is not vulnerable to these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2002:218",
        "url": "https://access.redhat.com/errata/RHSA-2002:218"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=103288242014253\u0026w=2",
        "url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=103288242014253\u0026w=2"
      },
      {
        "category": "external",
        "summary": "71144",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=71144"
      },
      {
        "category": "external",
        "summary": "71175",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=71175"
      },
      {
        "category": "external",
        "summary": "71177",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=71177"
      },
      {
        "category": "external",
        "summary": "73724",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=73724"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2002/rhsa-2002_218.json"
      }
    ],
    "title": "Red Hat Security Advisory: tomcat security update for Stronghold",
    "tracking": {
      "current_release_date": "2025-10-09T12:32:31+00:00",
      "generator": {
        "date": "2025-10-09T12:32:31+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.9"
        }
      },
      "id": "RHSA-2002:218",
      "initial_release_date": "2002-11-05T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2002-11-05T00:00:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2002-09-30T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-10-09T12:32:31+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Stronghold 4 for Red Hat Enterprise Linux",
                "product": {
                  "name": "Stronghold 4 for Red Hat Enterprise Linux",
                  "product_id": "Stronghold 4 for Red Hat Enterprise Linux",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_stronghold:4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Stronghold 4.0 for Red Hat Advanced Server"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2002-1148",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616844"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Stronghold 4 for Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-1148"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616844",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616844"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-1148",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-1148"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1148",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1148"
        }
      ],
      "release_date": "2002-09-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-05T00:00:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Stronghold 4 for Red Hat Enterprise Linux"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:218"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "security flaw"
    }
  ]
}

RHSA-2002:217

Vulnerability from csaf_redhat

Published

2002-11-08 11:16

Modified

2025-10-09 12:32

Summary

Red Hat Security Advisory: tomcat security update for Stronghold

Notes

Topic

Updated tomcat packages are now available for Stronghold Cross Platform to close a JSP source code exposure vulnerability.

Details

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. A source code exposure vulnerability has been found that affects Tomcat versions 4.0.0 through 4.0.4 and 4.1.0 through 4.1.10. Using a carefully crafted request, a remote attacker can read the source code of any deployed JSP file. Stronghold Cross Platform shipped with Tomcat version 4.0.3 and is therefore susceptible to this vulnerability. All users are advised to upgrade to these errata packages containing Tomcat version 4.0.5 which is not vulnerable to this issue.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated tomcat packages are now available for Stronghold Cross Platform to\nclose a JSP source code exposure vulnerability.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Tomcat is the servlet container that is used in the official Reference\nImplementation for the Java Servlet and JavaServer Pages technologies.  A\nsource code exposure vulnerability has been found that affects Tomcat\nversions 4.0.0 through 4.0.4 and 4.1.0 through 4.1.10.\n\nUsing a carefully crafted request, a remote attacker can read the source\ncode of any deployed JSP file.\n\nStronghold Cross Platform shipped with Tomcat version 4.0.3 and is\ntherefore susceptible to this vulnerability.\n\nAll users are advised to upgrade to these errata packages containing\nTomcat version 4.0.5 which is not vulnerable to this issue.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2002:217",
        "url": "https://access.redhat.com/errata/RHSA-2002:217"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=103288242014253\u0026w=2",
        "url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=103288242014253\u0026w=2"
      },
      {
        "category": "external",
        "summary": "71144",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=71144"
      },
      {
        "category": "external",
        "summary": "71167",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=71167"
      },
      {
        "category": "external",
        "summary": "71175",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=71175"
      },
      {
        "category": "external",
        "summary": "71177",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=71177"
      },
      {
        "category": "external",
        "summary": "73724",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=73724"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2002/rhsa-2002_217.json"
      }
    ],
    "title": "Red Hat Security Advisory: tomcat security update for Stronghold",
    "tracking": {
      "current_release_date": "2025-10-09T12:32:30+00:00",
      "generator": {
        "date": "2025-10-09T12:32:30+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.9"
        }
      },
      "id": "RHSA-2002:217",
      "initial_release_date": "2002-11-08T11:16:00+00:00",
      "revision_history": [
        {
          "date": "2002-11-08T11:16:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2002-09-30T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-10-09T12:32:30+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Stronghold 4",
                "product": {
                  "name": "Red Hat Stronghold 4",
                  "product_id": "Red Hat Stronghold 4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:stronghold:4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Stronghold Cross Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2002-1148",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616844"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Stronghold 4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-1148"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616844",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616844"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-1148",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-1148"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1148",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1148"
        }
      ],
      "release_date": "2002-09-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-08T11:16:00+00:00",
          "details": "The updated packages are now available via the update agent service. Run\nthe command\n\n$ bin/agent\n\nfrom the Stronghold 4 install root to upgrade an existing Stronghold 4\ninstallation to the new package versions.  After upgrading Stronghold, the\nserver must be completely restarted by running the following commands from\nthe install root:\n\n$ bin/stop-server\n$ bin/stop-tomcat\n$ bin/start-tomcat\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nsee http://stronghold.redhat.com/support/upgrade-sh4",
          "product_ids": [
            "Red Hat Stronghold 4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:217"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "security flaw"
    }
  ]
}

rhsa-2002_217

Vulnerability from csaf_redhat

Published

2002-11-08 11:16

Modified

2024-11-21 22:29

Summary

Red Hat Security Advisory: tomcat security update for Stronghold

Notes

Topic

Updated tomcat packages are now available for Stronghold Cross Platform to close a JSP source code exposure vulnerability.

Details

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. A source code exposure vulnerability has been found that affects Tomcat versions 4.0.0 through 4.0.4 and 4.1.0 through 4.1.10. Using a carefully crafted request, a remote attacker can read the source code of any deployed JSP file. Stronghold Cross Platform shipped with Tomcat version 4.0.3 and is therefore susceptible to this vulnerability. All users are advised to upgrade to these errata packages containing Tomcat version 4.0.5 which is not vulnerable to this issue.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated tomcat packages are now available for Stronghold Cross Platform to\nclose a JSP source code exposure vulnerability.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Tomcat is the servlet container that is used in the official Reference\nImplementation for the Java Servlet and JavaServer Pages technologies.  A\nsource code exposure vulnerability has been found that affects Tomcat\nversions 4.0.0 through 4.0.4 and 4.1.0 through 4.1.10.\n\nUsing a carefully crafted request, a remote attacker can read the source\ncode of any deployed JSP file.\n\nStronghold Cross Platform shipped with Tomcat version 4.0.3 and is\ntherefore susceptible to this vulnerability.\n\nAll users are advised to upgrade to these errata packages containing\nTomcat version 4.0.5 which is not vulnerable to this issue.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2002:217",
        "url": "https://access.redhat.com/errata/RHSA-2002:217"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=103288242014253\u0026w=2",
        "url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=103288242014253\u0026w=2"
      },
      {
        "category": "external",
        "summary": "71144",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=71144"
      },
      {
        "category": "external",
        "summary": "71167",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=71167"
      },
      {
        "category": "external",
        "summary": "71175",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=71175"
      },
      {
        "category": "external",
        "summary": "71177",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=71177"
      },
      {
        "category": "external",
        "summary": "73724",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=73724"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2002/rhsa-2002_217.json"
      }
    ],
    "title": "Red Hat Security Advisory: tomcat security update for Stronghold",
    "tracking": {
      "current_release_date": "2024-11-21T22:29:32+00:00",
      "generator": {
        "date": "2024-11-21T22:29:32+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2002:217",
      "initial_release_date": "2002-11-08T11:16:00+00:00",
      "revision_history": [
        {
          "date": "2002-11-08T11:16:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2002-09-30T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-21T22:29:32+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Stronghold 4",
                "product": {
                  "name": "Red Hat Stronghold 4",
                  "product_id": "Red Hat Stronghold 4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:stronghold:4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Stronghold Cross Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2002-1148",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616844"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Stronghold 4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-1148"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616844",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616844"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-1148",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-1148"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1148",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1148"
        }
      ],
      "release_date": "2002-09-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-08T11:16:00+00:00",
          "details": "The updated packages are now available via the update agent service. Run\nthe command\n\n$ bin/agent\n\nfrom the Stronghold 4 install root to upgrade an existing Stronghold 4\ninstallation to the new package versions.  After upgrading Stronghold, the\nserver must be completely restarted by running the following commands from\nthe install root:\n\n$ bin/stop-server\n$ bin/stop-tomcat\n$ bin/start-tomcat\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nsee http://stronghold.redhat.com/support/upgrade-sh4",
          "product_ids": [
            "Red Hat Stronghold 4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:217"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "security flaw"
    }
  ]
}

rhsa-2002:217

Vulnerability from csaf_redhat

Published

2002-11-08 11:16

Modified

2025-10-09 12:32

Summary

Red Hat Security Advisory: tomcat security update for Stronghold

Notes

Topic

Updated tomcat packages are now available for Stronghold Cross Platform to close a JSP source code exposure vulnerability.

Details

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. A source code exposure vulnerability has been found that affects Tomcat versions 4.0.0 through 4.0.4 and 4.1.0 through 4.1.10. Using a carefully crafted request, a remote attacker can read the source code of any deployed JSP file. Stronghold Cross Platform shipped with Tomcat version 4.0.3 and is therefore susceptible to this vulnerability. All users are advised to upgrade to these errata packages containing Tomcat version 4.0.5 which is not vulnerable to this issue.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated tomcat packages are now available for Stronghold Cross Platform to\nclose a JSP source code exposure vulnerability.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Tomcat is the servlet container that is used in the official Reference\nImplementation for the Java Servlet and JavaServer Pages technologies.  A\nsource code exposure vulnerability has been found that affects Tomcat\nversions 4.0.0 through 4.0.4 and 4.1.0 through 4.1.10.\n\nUsing a carefully crafted request, a remote attacker can read the source\ncode of any deployed JSP file.\n\nStronghold Cross Platform shipped with Tomcat version 4.0.3 and is\ntherefore susceptible to this vulnerability.\n\nAll users are advised to upgrade to these errata packages containing\nTomcat version 4.0.5 which is not vulnerable to this issue.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2002:217",
        "url": "https://access.redhat.com/errata/RHSA-2002:217"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=103288242014253\u0026w=2",
        "url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=103288242014253\u0026w=2"
      },
      {
        "category": "external",
        "summary": "71144",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=71144"
      },
      {
        "category": "external",
        "summary": "71167",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=71167"
      },
      {
        "category": "external",
        "summary": "71175",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=71175"
      },
      {
        "category": "external",
        "summary": "71177",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=71177"
      },
      {
        "category": "external",
        "summary": "73724",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=73724"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2002/rhsa-2002_217.json"
      }
    ],
    "title": "Red Hat Security Advisory: tomcat security update for Stronghold",
    "tracking": {
      "current_release_date": "2025-10-09T12:32:30+00:00",
      "generator": {
        "date": "2025-10-09T12:32:30+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.9"
        }
      },
      "id": "RHSA-2002:217",
      "initial_release_date": "2002-11-08T11:16:00+00:00",
      "revision_history": [
        {
          "date": "2002-11-08T11:16:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2002-09-30T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-10-09T12:32:30+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Stronghold 4",
                "product": {
                  "name": "Red Hat Stronghold 4",
                  "product_id": "Red Hat Stronghold 4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:stronghold:4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Stronghold Cross Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2002-1148",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616844"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Stronghold 4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-1148"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616844",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616844"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-1148",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-1148"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1148",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1148"
        }
      ],
      "release_date": "2002-09-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-08T11:16:00+00:00",
          "details": "The updated packages are now available via the update agent service. Run\nthe command\n\n$ bin/agent\n\nfrom the Stronghold 4 install root to upgrade an existing Stronghold 4\ninstallation to the new package versions.  After upgrading Stronghold, the\nserver must be completely restarted by running the following commands from\nthe install root:\n\n$ bin/stop-server\n$ bin/stop-tomcat\n$ bin/start-tomcat\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nsee http://stronghold.redhat.com/support/upgrade-sh4",
          "product_ids": [
            "Red Hat Stronghold 4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:217"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "security flaw"
    }
  ]
}

RHSA-2002:218

Vulnerability from csaf_redhat

Published

2002-11-05 00:00

Modified

2025-10-09 12:32

Summary

Red Hat Security Advisory: tomcat security update for Stronghold

Notes

Topic

Updated tomcat packages are now available for Stronghold on Red Hat Linux Advanced Server to close a JSP source code exposure vulnerability.

Details

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated tomcat packages are now available for Stronghold on Red Hat Linux\nAdvanced Server to close a JSP source code exposure vulnerability.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Tomcat is the servlet container that is used in the official Reference\nImplementation for the Java Servlet and JavaServer Pages technologies.  A\nsource code exposure vulnerability has been found that affects  Tomcat\nversions 4.0.0 through 4.0.4 and 4.1.0 through 4.1.10.\n\nUsing a carefully crafted request, a remote attacker can read the source\ncode of any deployed JSP file.\n\nStronghold for Red Hat Linux Advanced Server shipped with Tomcat version\n4.0.3 and is therefore susceptible to this vulnerability.\n\nAll users are advised to upgrade to these errata packages containing\nTomcat version 4.0.5 which is not vulnerable to these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2002:218",
        "url": "https://access.redhat.com/errata/RHSA-2002:218"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=103288242014253\u0026w=2",
        "url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=103288242014253\u0026w=2"
      },
      {
        "category": "external",
        "summary": "71144",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=71144"
      },
      {
        "category": "external",
        "summary": "71175",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=71175"
      },
      {
        "category": "external",
        "summary": "71177",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=71177"
      },
      {
        "category": "external",
        "summary": "73724",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=73724"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2002/rhsa-2002_218.json"
      }
    ],
    "title": "Red Hat Security Advisory: tomcat security update for Stronghold",
    "tracking": {
      "current_release_date": "2025-10-09T12:32:31+00:00",
      "generator": {
        "date": "2025-10-09T12:32:31+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.9"
        }
      },
      "id": "RHSA-2002:218",
      "initial_release_date": "2002-11-05T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2002-11-05T00:00:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2002-09-30T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-10-09T12:32:31+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Stronghold 4 for Red Hat Enterprise Linux",
                "product": {
                  "name": "Stronghold 4 for Red Hat Enterprise Linux",
                  "product_id": "Stronghold 4 for Red Hat Enterprise Linux",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_stronghold:4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Stronghold 4.0 for Red Hat Advanced Server"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2002-1148",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616844"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Stronghold 4 for Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-1148"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616844",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616844"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-1148",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-1148"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1148",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1148"
        }
      ],
      "release_date": "2002-09-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-05T00:00:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Stronghold 4 for Red Hat Enterprise Linux"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:218"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "security flaw"
    }
  ]
}

rhsa-2002_218

Vulnerability from csaf_redhat

Published

2002-11-05 00:00

Modified

2024-11-21 22:29

Summary

Red Hat Security Advisory: tomcat security update for Stronghold

Notes

Topic

Updated tomcat packages are now available for Stronghold on Red Hat Linux Advanced Server to close a JSP source code exposure vulnerability.

Details

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated tomcat packages are now available for Stronghold on Red Hat Linux\nAdvanced Server to close a JSP source code exposure vulnerability.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Tomcat is the servlet container that is used in the official Reference\nImplementation for the Java Servlet and JavaServer Pages technologies.  A\nsource code exposure vulnerability has been found that affects  Tomcat\nversions 4.0.0 through 4.0.4 and 4.1.0 through 4.1.10.\n\nUsing a carefully crafted request, a remote attacker can read the source\ncode of any deployed JSP file.\n\nStronghold for Red Hat Linux Advanced Server shipped with Tomcat version\n4.0.3 and is therefore susceptible to this vulnerability.\n\nAll users are advised to upgrade to these errata packages containing\nTomcat version 4.0.5 which is not vulnerable to these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2002:218",
        "url": "https://access.redhat.com/errata/RHSA-2002:218"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=103288242014253\u0026w=2",
        "url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=103288242014253\u0026w=2"
      },
      {
        "category": "external",
        "summary": "71144",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=71144"
      },
      {
        "category": "external",
        "summary": "71175",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=71175"
      },
      {
        "category": "external",
        "summary": "71177",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=71177"
      },
      {
        "category": "external",
        "summary": "73724",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=73724"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2002/rhsa-2002_218.json"
      }
    ],
    "title": "Red Hat Security Advisory: tomcat security update for Stronghold",
    "tracking": {
      "current_release_date": "2024-11-21T22:29:37+00:00",
      "generator": {
        "date": "2024-11-21T22:29:37+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2002:218",
      "initial_release_date": "2002-11-05T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2002-11-05T00:00:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2002-09-30T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-21T22:29:37+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Stronghold 4 for Red Hat Enterprise Linux",
                "product": {
                  "name": "Stronghold 4 for Red Hat Enterprise Linux",
                  "product_id": "Stronghold 4 for Red Hat Enterprise Linux",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_stronghold:4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Stronghold 4.0 for Red Hat Advanced Server"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2002-1148",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616844"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Stronghold 4 for Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-1148"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616844",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616844"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-1148",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-1148"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1148",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1148"
        }
      ],
      "release_date": "2002-09-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-05T00:00:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Stronghold 4 for Red Hat Enterprise Linux"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:218"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "security flaw"
    }
  ]
}

fkie_cve-2002-1148

Vulnerability from fkie_nvd

Published

2002-10-11 04:00

Modified

2025-04-03 01:03

Severity ?

Summary

References

URL	Tags
cve@mitre.org	http://marc.info/?l=bugtraq&m=103288242014253&w=2
cve@mitre.org	http://online.securityfocus.com/advisories/4758
cve@mitre.org	http://www.debian.org/security/2002/dsa-170
cve@mitre.org	http://www.iss.net/security_center/static/10175.php	Vendor Advisory
cve@mitre.org	http://www.redhat.com/support/errata/RHSA-2002-217.html
cve@mitre.org	http://www.redhat.com/support/errata/RHSA-2002-218.html
cve@mitre.org	http://www.securityfocus.com/bid/5786	Exploit, Patch, Vendor Advisory
cve@mitre.org	https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
cve@mitre.org	https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E
cve@mitre.org	https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108	http://marc.info/?l=bugtraq&m=103288242014253&w=2
af854a3a-2127-422b-91ae-364da2661108	http://online.securityfocus.com/advisories/4758
af854a3a-2127-422b-91ae-364da2661108	http://www.debian.org/security/2002/dsa-170
af854a3a-2127-422b-91ae-364da2661108	http://www.iss.net/security_center/static/10175.php	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.redhat.com/support/errata/RHSA-2002-217.html
af854a3a-2127-422b-91ae-364da2661108	http://www.redhat.com/support/errata/RHSA-2002-218.html
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/5786	Exploit, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108	https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108	https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E

Impacted products

Vendor	Product	Version
apache	tomcat	3.0
apache	tomcat	3.1
apache	tomcat	3.1.1
apache	tomcat	3.2
apache	tomcat	3.2.1
apache	tomcat	3.2.2
apache	tomcat	3.2.3
apache	tomcat	3.2.4
apache	tomcat	3.3
apache	tomcat	3.3.1
apache	tomcat	4.0.0
apache	tomcat	4.0.1
apache	tomcat	4.0.2
apache	tomcat	4.0.3
apache	tomcat	4.0.4
apache	tomcat	4.1.0
apache	tomcat	4.1.3
apache	tomcat	4.1.9
apache	tomcat	4.1.10

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "BAFF8D91-80A2-454A-8B44-A5A889002692",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FEC42876-65AD-476A-8B62-25D4E15D1BB6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:3.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "724A8FF9-8089-4302-8200-08987A712988",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "3F97DDB7-E32B-422F-8AEA-07C75DEAD36E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:3.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7079F63C-7CA8-4909-A9C8-45C4C1C1C186",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:3.2.2:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "4BE08AEE-4801-4FAF-97AD-BBD5C5849E3D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:3.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "EC829C8E-1061-4F62-BA4B-FE5C7F11F209",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:3.2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "143BA75E-A186-47EF-A18C-B1A1A1F61C00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "C0CDF9E1-9412-450E-B1D4-438F128FFF9E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:3.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "32561F50-6385-4D71-AFAC-3D2F8DB55A4B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "914E1404-01A2-4F94-AA40-D5EA20F55AD3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "81FB1106-B26D-45BE-A511-8E69131BBA52",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "401A213A-FED3-49C0-B823-2E02EA528905",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "0BFE5AD8-DB14-4632-9D2A-F2013579CA7D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "7641278D-3B8B-4CD2-B284-2047B65514A2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E300013-0CE7-4313-A553-74A6A247B3E9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.3:beta:*:*:*:*:*:*",
              "matchCriteriaId": "B7E52BE7-5281-4430-8846-E41CF34FC214",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.9:beta:*:*:*:*:*:*",
              "matchCriteriaId": "CBDA8066-294D-431E-B026-C03707DFBCD5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:4.1.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "C92F3744-C8F9-4E29-BF1A-25E03A32F2C0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet."
    },
    {
      "lang": "es",
      "value": "El servlet por defecto (org.apache.catalina.servlets.DefaultServlet) en Tomcat 4.0.4 y 4.1.10 permite a atacantes remotos leer c\u00f3digo fuente de ficheros del servidor mediante una petici\u00f3n directa al servlet."
    }
  ],
  "id": "CVE-2002-1148",
  "lastModified": "2025-04-03T01:03:51.193",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2002-10-11T04:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://marc.info/?l=bugtraq\u0026m=103288242014253\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://online.securityfocus.com/advisories/4758"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2002/dsa-170"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.iss.net/security_center/static/10175.php"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2002-217.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2002-218.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/bid/5786"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=bugtraq\u0026m=103288242014253\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://online.securityfocus.com/advisories/4758"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2002/dsa-170"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.iss.net/security_center/static/10175.php"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2002-217.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2002-218.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/bid/5786"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

gsd-2002-1148

Vulnerability from gsd

Modified

2023-12-13 01:24

Details

Aliases

CVE-2002-1148

Aliases

CVE-2002-1148

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2002-1148",
    "description": "The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.",
    "id": "GSD-2002-1148",
    "references": [
      "https://www.debian.org/security/2002/dsa-170",
      "https://access.redhat.com/errata/RHSA-2002:218",
      "https://access.redhat.com/errata/RHSA-2002:217"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2002-1148"
      ],
      "details": "The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.",
      "id": "GSD-2002-1148",
      "modified": "2023-12-13T01:24:10.904697Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2002-1148",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "DSA-170",
            "refsource": "DEBIAN",
            "url": "http://www.debian.org/security/2002/dsa-170"
          },
          {
            "name": "5786",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/5786"
          },
          {
            "name": "RHSA-2002:217",
            "refsource": "REDHAT",
            "url": "http://www.redhat.com/support/errata/RHSA-2002-217.html"
          },
          {
            "name": "tomcat-servlet-source-code(10175)",
            "refsource": "XF",
            "url": "http://www.iss.net/security_center/static/10175.php"
          },
          {
            "name": "HPSBUX0212-229",
            "refsource": "HP",
            "url": "http://online.securityfocus.com/advisories/4758"
          },
          {
            "name": "RHSA-2002:218",
            "refsource": "REDHAT",
            "url": "http://www.redhat.com/support/errata/RHSA-2002-218.html"
          },
          {
            "name": "20020924 JSP source code exposure in Tomcat 4.x",
            "refsource": "BUGTRAQ",
            "url": "http://marc.info/?l=bugtraq\u0026m=103288242014253\u0026w=2"
          },
          {
            "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:3.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:3.3.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:4.1.3:beta:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:4.1.9:beta:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:3.2.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:3.2.2:beta2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:3.2.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:4.0.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:3.2.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:3.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:4.1.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:3.1.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:3.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:4.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:tomcat:4.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2002-1148"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "5786",
              "refsource": "BID",
              "tags": [
                "Exploit",
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www.securityfocus.com/bid/5786"
            },
            {
              "name": "tomcat-servlet-source-code(10175)",
              "refsource": "XF",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://www.iss.net/security_center/static/10175.php"
            },
            {
              "name": "DSA-170",
              "refsource": "DEBIAN",
              "tags": [],
              "url": "http://www.debian.org/security/2002/dsa-170"
            },
            {
              "name": "HPSBUX0212-229",
              "refsource": "HP",
              "tags": [],
              "url": "http://online.securityfocus.com/advisories/4758"
            },
            {
              "name": "RHSA-2002:217",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://www.redhat.com/support/errata/RHSA-2002-217.html"
            },
            {
              "name": "RHSA-2002:218",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://www.redhat.com/support/errata/RHSA-2002-218.html"
            },
            {
              "name": "20020924 JSP source code exposure in Tomcat 4.x",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://marc.info/?l=bugtraq\u0026m=103288242014253\u0026w=2"
            },
            {
              "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2019-03-25T11:29Z",
      "publishedDate": "2002-10-11T04:00Z"
    }
  }
}

CERTA-2008-AVI-349

Vulnerability from certfr_avis

Plusieurs vulnérabilités de Sun Solaris permettent à une personne malintentionnée d'effectuer, entre autres, un déni de service à distance.

Description

De multiples vulnérabilités non documentées du serveur Tomcat de Sun Solaris permettent à une personne malveillante d'effectuer un déni de service à distance, un courtournement de la politique de sécurité, une atteinte à la confidentialité des données ou une injection de code indirecte.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	N/A	N/A	Sun Solaris 10.
	N/A	N/A	Sun Solaris 9 ;

References

Title

Publication Time

ghsa-jxcv-v856-j5vg

Vulnerability from github

Published

2022-04-30 18:20

Modified

2024-02-12 19:42

Summary

Apache Tomcat Source Code Disclosure

Details

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.0.4"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.1.10"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.1.0"
            },
            {
              "fixed": "4.1.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2002-1148"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-12T19:42:47Z",
    "nvd_published_at": "2002-10-11T04:00:00Z",
    "severity": "MODERATE"
  },
  "details": "The default servlet (`org.apache.catalina.servlets.DefaultServlet`) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.",
  "id": "GHSA-jxcv-v856-j5vg",
  "modified": "2024-02-12T19:42:47Z",
  "published": "2022-04-30T18:20:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1148"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@\u003cdev.tomcat.apache.org\u003e"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@\u003cdev.tomcat.apache.org\u003e"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@\u003cdev.tomcat.apache.org\u003e"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20021027204137/http://www.iss.net/security_center/static/10175.php"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20030113141130/http://online.securityfocus.com/advisories/4758"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20030710185447/http://www.securityfocus.com/bid/5786"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20040814165854/http://rhn.redhat.com/errata/RHSA-2002-217.html"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20040817035804/http://rhn.redhat.com/errata/RHSA-2002-218.html"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20070430075037/http://www.debian.org/security/2002/dsa-170"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=103288242014253\u0026w=2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Apache Tomcat Source Code Disclosure"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2002-1148 (GCVE-0-2002-1148)

Vulnerability from cvelistv5

Vulnerability from csaf_redhat

Vulnerability from csaf_redhat

Vulnerability from csaf_redhat

Vulnerability from csaf_redhat

Vulnerability from csaf_redhat

Vulnerability from csaf_redhat

Vulnerability from fkie_nvd

Vulnerability from gsd

Vulnerability from certfr_avis

Description

Solution

Vulnerability from github

Tags

Sightings

Nomenclature