high7.8Public exploit code
CVE-2002-2272
Apache Tomcat DoS via Malicious Get Request
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Apache 1.3.x + Tomcat 4.0.x/4.1.x mod_jk - Chunked Encoding Denial of Service2002-12-04 · dos · unix · Verified
Impact
Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.tomcat:tomcat | >= 4.0.0, <= 4.1.12 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Http Server | Versions 1.3, 1.3.0, 1.3.1, 1.3.2, 1.3.10, 1.3.11 |
| Apache | Tomcat | Versions 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://archives.neohapsis.com/archives/bugtraq/2002-12/0045.html
- http://www.securityfocus.com/bid/6320
- https://exchange.xforce.ibmcloud.com/vulnerabilities/10771
- https://github.com/advisories/GHSA-pqr5-9v2j-44xg
- https://nvd.nist.gov/vuln/detail/CVE-2002-2272
- https://web.archive.org/web/20030501051114/http://www.securityfocus.com/bid/6320
- https://web.archive.org/web/20051124132812/http://archives.neohapsis.com/archives/bugtraq/2002-12/0045.html