5.0med
CVE-2003-00421 exploit
Jakarta Tomcat Directory Listing vulnerability
Also known as GHSA-qfw2-wvrw-mvw4
Published 23 y ago · modified 4 mo ago · JSON
CVSS
5.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
46.0%
percentile 99%
Public exploits
1
Exploit-DB
Summary
Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
Exploit prediction (EPSS)
46.03% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.
Exploits and detections
- EDB-22205 Apache Tomcat 3.x - Null Byte Directory / File Disclosure · remote · 2003-01-26
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.tomcat:tomcat | <3.3.1a | 3.3.1a |
Classification
- Weakness
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
- debian.org /security/2003/dsa-246 · vendor-advisory, x_refsource_DEBIAN, x_transferred
- securityfocus.com /bid/6721 · vdb-entry, x_refsource_BID, x_transferred
- jakarta.apache.org /builds/jakarta-tomcat/release/v3.3.1a/ · x_refsource_CONFIRM, x_transferred
- marc.info /?l=bugtraq&m=104394568616290&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
- securityfocus.com /advisories/5111 · vendor-advisory, x_refsource_HP, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/11194 · vdb-entry, x_refsource_XF, x_transferred
- ciac.org /ciac/bulletins/n-060.shtml · third-party-advisory, government-resource, x_refsource_CIAC, x_transferred
- secunia.com /advisories/7977 · third-party-advisory, x_refsource_SECUNIA, x_transferred
- secunia.com /advisories/7972 · third-party-advisory, x_refsource_SECUNIA, x_transferred
- jakarta.apache.org /builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt · x_refsource_CONFIRM, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2003-0042 · advisory
- github.com /apache/tomcat · package
- jakarta.apache.org /builds/jakarta-tomcat/release/v3.3.1a · web
Sources
- CVE List: CVE-2003-0042
- GitHub Advisory: GHSA-qfw2-wvrw-mvw4
- NVD: CVE-2003-0042
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.