GHSA-8v5p-2cpv-c2x6

Source

https://github.com/advisories/GHSA-8v5p-2cpv-c2x6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-8v5p-2cpv-c2x6/GHSA-8v5p-2cpv-c2x6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8v5p-2cpv-c2x6

Aliases

CVE-2002-1394

Published

2022-04-30T18:21:05Z

Modified

2024-02-12T20:12:12.091771Z

Summary

Apache Tomcat Source Code Disclosure

Details

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.

Database specific

{
    "nvd_published_at": "2003-01-17T05:00:00Z",
    "cwe_ids": [
        "CWE-200"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-12T19:58:01Z"
}

References

Affected packages

Maven / org.apache.tomcat:tomcat

Package

Name: org.apache.tomcat:tomcat; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.0.6

Database specific

{
    "last_known_affected_version_range": "<= 4.0.5"
}