Vulnerability in N/a
CVE-2002-1148
The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.
EPSS: 0.673 (98.6th percentile) — read the EPSS interpretation.
Affected products
- N/a — versions n/a
Public proof-of-concept exploits
References
- DSA-170 (vendor-advisory, x_refsource_DEBIAN)
- 5786 (vdb-entry, x_refsource_BID)
- RHSA-2002:217 (x_refsource_REDHAT, vendor-advisory)
- tomcat-servlet-source-code(10175) (vdb-entry, x_refsource_XF)
- HPSBUX0212-229 (x_refsource_HP, vendor-advisory)
- RHSA-2002:218 (x_refsource_REDHAT, vendor-advisory)
- 20020924 JSP source code exposure in Tomcat 4.x (mailing-list, x_refsource_BUGTRAQ)
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ (mailing-list, x_refsource_MLIST)
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ (mailing-list, x_refsource_MLIST)
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/ (mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2002-1148?
- CVE-2002-1148 is a vulnerability in N/a. Published 2004-09-01.
- Is CVE-2002-1148 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.