GitHub Advisoryadvisory · Maven

GHSA-qfw2-wvrw-mvw4 Jakarta Tomcat Directory Listing vulnerability

MEDIUM Published 2022-04-29 Modified 2023-09-18 Official page ↗
Aliases
CVE-2003-0042
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2023-09-18

Affected packages

• Maven org.apache.tomcat:tomcat: < 3.3.1a → fixed in 3.3.1a

Description

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.

Related

Alias · CVE (1)

  • CVE-2003-0042 Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References