CVE-2002-2006 Apache Tomcat Default Installation Reveals Sensitive Information
MediumCVSS 5.0
EPSS 30.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache tomcat | = 3.0 | No fix listed |
| apache tomcat | = 3.1 | No fix listed |
| apache tomcat | = 3.1.1 | No fix listed |
| apache tomcat | = 3.2 | No fix listed |
| apache tomcat | = 3.2.1 | No fix listed |
| apache tomcat | = 3.2.3 | No fix listed |
| apache tomcat | = 3.2.4 | No fix listed |
| apache tomcat | = 3.3 | No fix listed |
| apache tomcat | = 3.3.1 | No fix listed |
| apache tomcat | = 4.0.0 | No fix listed |
| apache tomcat | = 4.0.1 | No fix listed |
| apache tomcat | = 4.0.2 | No fix listed |
| apache tomcat | = 4.0.3 | No fix listed |
| apache tomcat | = 4.1.0 | No fix listed |
| org.apache.tomcat/tomcat(Maven) | >= 4.0.0, < 4.1.0 | 4.1.0 |
| org.apache.tomcat/tomcat(Maven) | >= 3.0, < 3.3a | 3.3a |
References
- 20020422 Tomcat real path disclosure (2) exploit mailing-list
- 30899 third-party-advisory
- 30908 third-party-advisory
- 239312 vendor-advisory
- tomcat.apache.org
- tomcat-example-class-information(8932) vdb-entry
- 4575 exploit vdb-entry
- ADV-2008-1979 vdb-entry
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/ mailing-list
- nvd.nist.gov third-party-advisory vendor-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- web.archive.org
- web.archive.org
- web.archive.org
- github.com