CVE-2002-2007
First published: Tue Dec 31 2002(Updated: )
The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Tomcat | =3.2.3 | |
| Apache Tomcat | =3.2.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://cert.uni-stuttgart.de/archive/bugtraq/2002/05/msg00272.html
- http://cert.uni-stuttgart.de/archive/bugtraq/2002/05/msg00275.html
- http://www.iss.net/security_center/static/9208.php
- http://www.kb.cert.org/vuls/id/116963
- http://www.procheckup.com/security_info/vuln_pr0205.html
- http://www.procheckup.com/security_info/vuln_pr0206.html
- http://www.procheckup.com/security_info/vuln_pr0207.html
- http://www.securityfocus.com/bid/4876
- http://www.securityfocus.com/bid/4877
- http://www.securityfocus.com/bid/4878
Frequently Asked Questions
What is the severity of CVE-2002-2007?
CVE-2002-2007 is rated as moderate in severity due to the potential exposure of sensitive system information.
How do I fix CVE-2002-2007?
To fix CVE-2002-2007, it is recommended to upgrade to a newer version of Apache Tomcat that is not vulnerable.
Which versions of Apache Tomcat are affected by CVE-2002-2007?
The affected versions are Apache Tomcat 3.2.3 and 3.2.4.
What information can be leaked due to CVE-2002-2007?
CVE-2002-2007 can allow remote attackers to obtain sensitive information, such as directory listings and the web root path.
Who is at risk from CVE-2002-2007?
Users running default installations of Apache Tomcat 3.2.3 and 3.2.4 without proper configuration are at risk from CVE-2002-2007.
- collector/nvd-index
- collector/nvd-historical
- agent/type
- agent/references
- agent/softwarecombine
- agent/first-publish-date
- agent/severity
- agent/author
- agent/weakness
- agent/description
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/source
- vendor/apache
- canonical/apache tomcat
- version/apache tomcat/3.2.3
- version/apache tomcat/3.2.4