1. CVE-Search
  2. CVE-2002-1148
ID CVE-2002-1148
Summary The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.
References
Vulnerable Configurations
  • cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:3.1:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:3.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:3.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:3.2:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:3.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:3.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:3.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:3.2.2:beta2:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:3.2.2:beta2:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:3.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:3.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:3.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:3.2.4:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:3.3:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:3.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:3.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:4.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:4.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:4.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:4.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:4.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:4.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:4.1.3:beta:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:4.1.3:beta:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:4.1.9:beta:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:4.1.9:beta:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:4.1.10:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:4.1.10:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 25-03-2019 - 11:29)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:N/A:N
redhat via4
advisories
  • rhsa
    id RHSA-2002:217
  • rhsa
    id RHSA-2002:218
refmap via4
bid 5786
bugtraq 20020924 JSP source code exposure in Tomcat 4.x
debian DSA-170
hp HPSBUX0212-229
mlist
  • [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
  • [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
  • [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
xf tomcat-servlet-source-code(10175)
Last major update 25-03-2019 - 11:29
Published 11-10-2002 - 04:00
Last modified 25-03-2019 - 11:29
Back to Top