GitHub Advisoryadvisory · Maven

GHSA-jxcv-v856-j5vg Apache Tomcat Source Code Disclosure

MEDIUM Published 2022-04-30 Modified 2024-02-12 Official page ↗
Aliases
CVE-2002-1148
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2024-02-12

Affected packages

• Maven org.apache.tomcat:tomcat: >= 4.0.0, < 4.0.5 → fixed in 4.0.5 • Maven org.apache.tomcat:tomcat: >= 4.1.0, < 4.1.12 → fixed in 4.1.12

Description

The default servlet (`org.apache.catalina.servlets.DefaultServlet`) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

Related

Alias · CVE (1)

  • CVE-2002-1148 The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References