CVE-2002-2007
First published: Tue Dec 31 2002(Updated: )
The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Tomcat | =3.2.3 | |
| Apache Tomcat | =3.2.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://cert.uni-stuttgart.de/archive/bugtraq/2002/05/msg00272.html
- http://cert.uni-stuttgart.de/archive/bugtraq/2002/05/msg00275.html
- http://www.iss.net/security_center/static/9208.php
- http://www.kb.cert.org/vuls/id/116963
- http://www.procheckup.com/security_info/vuln_pr0205.html
- http://www.procheckup.com/security_info/vuln_pr0206.html
- http://www.procheckup.com/security_info/vuln_pr0207.html
- http://www.securityfocus.com/bid/4876
- http://www.securityfocus.com/bid/4877
- http://www.securityfocus.com/bid/4878
- collector/nvd-index
- collector/nvd-historical
- agent/type
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/tags
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/apache
- canonical/apache tomcat
- version/apache tomcat/3.2.3
- version/apache tomcat/3.2.4