GitHub Advisoryadvisory · Maven

GHSA-8v5p-2cpv-c2x6 Apache Tomcat Source Code Disclosure

HIGH Published 2022-04-30 Modified 2024-02-12 Official page ↗
Aliases
CVE-2002-1394
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
High
Weaknesses
CWE-200
Reviewed
2024-02-12

Affected packages

• Maven org.apache.tomcat:tomcat: < 4.0.6 → fixed in 4.0.6

Description

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.

Related

Alias · CVE (1)

  • CVE-2002-1394 Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References