CVE-2002-2007

The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages.

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

41.40% chance of exploitation in the next 30 days, 99th percentile

Published

2005-07-14

Updated

2024-09-17

ExploitDB entries (3)

• https://www.exploit-db.com/exploits/21492
• https://www.exploit-db.com/exploits/21491
• https://www.exploit-db.com/exploits/21490

References

• CVE Record
• NVD entry

Related

• CVE-2002-2006
• CVE-2002-2011
• CVE-2002-20001
• CVE-2002-2013
• CVE-2002-1998
• CVE-2002-2015