CVE-2002-1148: Infoleak
The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.
Other sources
The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2002-1148?
CVE-2002-1148 is considered a critical vulnerability as it allows unauthorized access to server source code.
How do I fix CVE-2002-1148?
To fix CVE-2002-1148, upgrade to Apache Tomcat version 4.1.12 or higher for the 4.x branch, and 4.0.5 or higher for the 4.0.x branch.
Which versions of Apache Tomcat are affected by CVE-2002-1148?
Affected versions of Apache Tomcat include 3.0, 3.1, 3.2, 4.0.0 through 4.1.10, and related beta versions.
What are the risks of not addressing CVE-2002-1148?
Failing to address CVE-2002-1148 can lead to significant data breaches as attackers can access sensitive server files.
How can CVE-2002-1148 be exploited?
CVE-2002-1148 can be exploited by making a direct request to the default servlet, enabling remote attackers to read source code.