CVE-2002-2272 Apache Tomcat DoS via Malicious Get Request
HighCVSS 7.8
EPSS 9.7%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache HTTP Server | = 1.3 | No fix listed |
| Apache HTTP Server | = 1.3.0 | No fix listed |
| Apache HTTP Server | = 1.3.1 | No fix listed |
| Apache HTTP Server | = 1.3.2 | No fix listed |
| Apache HTTP Server | = 1.3.10 | No fix listed |
| Apache HTTP Server | = 1.3.11 | No fix listed |
| Apache HTTP Server | = 1.3.12 | No fix listed |
| Apache HTTP Server | = 1.3.13 | No fix listed |
| Apache HTTP Server | = 1.3.14 | No fix listed |
| Apache HTTP Server | = 1.3.15 | No fix listed |
| Apache HTTP Server | = 1.3.16 | No fix listed |
| Apache HTTP Server | = 1.3.17 | No fix listed |
| Apache HTTP Server | = 1.3.18 | No fix listed |
| Apache HTTP Server | = 1.3.19 | No fix listed |
| Apache HTTP Server | = 1.3.20 | No fix listed |
| Apache HTTP Server | = 1.3.22 | No fix listed |
| Apache HTTP Server | = 1.3.23 | No fix listed |
| Apache HTTP Server | = 1.3.24 | No fix listed |
| Apache HTTP Server | = 1.3.25 | No fix listed |
| Apache HTTP Server | = 1.3.26 | No fix listed |
| Apache HTTP Server | = 1.3.27 | No fix listed |
| apache tomcat | = 4.0.0 | No fix listed |
| apache tomcat | = 4.0.1 | No fix listed |
| apache tomcat | = 4.0.2 | No fix listed |
| apache tomcat | = 4.0.3 | No fix listed |
Show 12 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apache tomcat | = 4.0.4 | No fix listed |
| apache tomcat | = 4.0.5 | No fix listed |
| apache tomcat | = 4.0.6 | No fix listed |
| apache tomcat | = 4.1.0 | No fix listed |
| apache tomcat | = 4.1.1 | No fix listed |
| apache tomcat | = 4.1.2 | No fix listed |
| apache tomcat | = 4.1.3 | No fix listed |
| apache tomcat | = 4.1.3-beta | No fix listed |
| apache tomcat | = 4.1.9-beta | No fix listed |
| apache tomcat | = 4.1.10 | No fix listed |
| apache tomcat | = 4.1.12 | No fix listed |
| org.apache.tomcat/tomcat(Maven) | >= 4.0.0, <= 4.1.12 | No fix listed |
References
- 20021204 Apache/Tomcat Denial Of Service And Information Leakage Vulnerability mailing-list patch
- 6320 exploit patch vdb-entry
- tomcat-modjk-get-bo(10771) vdb-entry
- nvd.nist.gov third-party-advisory vendor-advisory
- web.archive.org
- web.archive.org
- github.com