CVE-2002-2006: Medium severity Apache Tomcat vulnerability
The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 3.3a - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 4.1.0
Event History
Frequently Asked Questions
What is the severity of CVE-2002-2006?
CVE-2002-2006 is considered a medium severity vulnerability due to its potential exposure of sensitive system information.
How do I fix CVE-2002-2006?
To fix CVE-2002-2006, upgrade to Apache Tomcat version 3.3a or later for versions 3.0 to 3.3.1, and to version 4.1.0 or later for versions 4.0.0 to 4.1.
What versions are affected by CVE-2002-2006?
CVE-2002-2006 affects Apache Tomcat versions 3.0 through 4.1, including various sub-versions in-between.
How does CVE-2002-2006 impact Apache Tomcat security?
CVE-2002-2006 allows remote attackers to obtain the installation path and sensitive system information, potentially leading to further exploitation.
Is there a workaround for CVE-2002-2006?
While the best approach is to upgrade to a patched version, a temporary workaround may include disabling the SnoopServlet and TroubleShooter example servlets.