Apache Tomcat may be started without proper security settings

Also known as GHSA-p543-jg43-9pm5

Published 24 y ago 2002-08-12 · modified 4 mo ago 2026-06-16 · JSON

CVSS

7.5

v2.0 · NVD

CISA KEV

not known exploited

EPSS

3.8%

percentile 90%

Public exploits

none known

Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.

Exploit prediction (EPSS)

3.80% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.apache.tomcat:tomcat`	<4.0b7	4.0b7

Classification

Weakness

CWE-254 7PK - Security Features
CWE-276 Incorrect Default Permissions

References

apachelabs.org /tomcat-dev/200108.mbox/%3C20010810000819.6350.qmail%40icarus.apache.org%3E · x_refsource_MISC, x_transferred
iss.net /security_center/static/9863.php · vdb-entry, x_refsource_XF, x_transferred
marc.info /?l=bugtraq&m=101709002410365&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
lists.apache.org /thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
nvd.nist.gov /vuln/detail/CVE-2002-0493 · advisory
github.com /apache/tomcat · package
lists.apache.org /thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache · web
lists.apache.org /thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache · web
lists.apache.org /thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apach · web
web.archive.org /web/20020903071650/http://www.iss.net/security_center/static/9863.php · web

Sources

CVE List: CVE-2002-0493
GitHub Advisory: GHSA-p543-jg43-9pm5
NVD: CVE-2002-0493

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.