GHSA-jxcv-v856-j5vg

Source

https://github.com/advisories/GHSA-jxcv-v856-j5vg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-jxcv-v856-j5vg/GHSA-jxcv-v856-j5vg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-jxcv-v856-j5vg

Aliases

CVE-2002-1148

Published

2022-04-30T18:20:37Z

Modified

2024-02-12T19:58:26.540500Z

Summary

Apache Tomcat Source Code Disclosure

Details

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

Database specific

{
    "github_reviewed_at": "2024-02-12T19:42:47Z",
    "cwe_ids": [
        "CWE-200"
    ],
    "nvd_published_at": "2002-10-11T04:00:00Z",
    "severity": "MODERATE",
    "github_reviewed": true
}

References

Affected packages

Maven / org.apache.tomcat:tomcat

Package

Name: org.apache.tomcat:tomcat; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.0.0

Fixed

4.0.5

Database specific

{
    "last_known_affected_version_range": "<= 4.0.4"
}

Maven / org.apache.tomcat:tomcat

Package

Name: org.apache.tomcat:tomcat; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.1.0

Fixed

4.1.12

Database specific

{
    "last_known_affected_version_range": "<= 4.1.10"
}