vulnwire
5.0med

CVE-2002-20073 exploits

The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory…

Published 23 y ago · modified 4 mo ago · JSON

CVSS
5.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
41.4%
percentile 99%
Public exploits
3
Exploit-DB

The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages.

Exploit prediction (EPSS)

41.40% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.

Exploits and detections

  • EDB-21492 Apache Tomcat 3.2.3/3.2.4 - 'RealPath.jsp' Information Disclosuree · remote · 2002-05-29
  • EDB-21491 Apache Tomcat 3.2.3/3.2.4 - Example Files Web Root Full Path Disclosure · remote · 2002-05-29
  • EDB-21490 Apache Tomcat 3.2.3/3.2.4 - 'Source.jsp' Information Disclosure · remote · 2002-05-29

CVSS scores

Assigned byVersionScoreVector
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

References

  • kb.cert.org /vuls/id/116963 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • securityfocus.com /bid/4876 · vdb-entry, x_refsource_BID, x_transferred
  • procheckup.com /security_info/vuln_pr0206.html · x_refsource_MISC, x_transferred
  • procheckup.com /security_info/vuln_pr0205.html · x_refsource_MISC, x_transferred
  • iss.net /security_center/static/9208.php · vdb-entry, x_refsource_XF, x_transferred
  • cert.uni-stuttgart.de /archive/bugtraq/2002/05/msg00275.html · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • cert.uni-stuttgart.de /archive/bugtraq/2002/05/msg00272.html · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • procheckup.com /security_info/vuln_pr0207.html · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/4877 · vdb-entry, x_refsource_BID, x_transferred
  • securityfocus.com /bid/4878 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.