medium5.0Public exploit code

CVE-2002-2007

The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web ro…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Apache Tomcat 3.2.3/3.2.4 - 'RealPath.jsp' Information Disclosuree2002-05-29 · remote · multiple · Verified
Apache Tomcat 3.2.3/3.2.4 - Example Files Web Root Full Path Disclosure2002-05-29 · remote · multiple · Verified
Apache Tomcat 3.2.3/3.2.4 - 'Source.jsp' Information Disclosure2002-05-29 · remote · multiple · Verified

Impact

The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages.

Affected products

Vendor	Product	Affected versions
Apache	Tomcat	Versions 3.2.3, 3.2.4

Public exploit code

Impact

Affected products

References