The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier
    allows remote attackers to read source code for server files via a direct request to the servlet.
    (CVE-2002-1148)

A security vulnerability has been found in all Tomcat 4.x releases.
This problem allows an attacker to use a specially crafted URL to return the unprocessed source code of a JSP page, or, under special circumstances, a static resource which would otherwise have been protected by security constraints, without the need for being properly authenticated.

Tomcat 4.0.4 and 4.1.10 (and possibly earlier versions) are vulnerable to source code disclosure by using the default servlet org.apache.catalina.servlets.DefaultServlet

The version of Apache Tomcat running on the remote host is affected by an information disclosure vulnerability. It is possible to view source code using the default servlet :

  org.apache.catalina.servlets.DefaultServlet

A remote attacker can exploit this information to mount further attacks.

This version of Tomcat reportedly affected by additional vulnerabilities; however, Nessus has not checked for them.

ID	Name	Product	Family	Type	Severity
432033	SCA: security update for org.apache.tomcat:tomcat (GHSA-jxcv-v856-j5vg)	Tenable Cloud Security	SCA Checks	Local	high
432033	SCA: security update for org.apache.tomcat:tomcat (GHSA-jxcv-v856-j5vg)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
15007	Debian DSA-170-1 : tomcat4 - source code disclosure	Nessus	Debian Local Security Checks	Local	medium
1463	Apache Tomcat 4.0.x < 4.0.5 / 4.1.x < 4.1.11 JSP Source Code Disclosure	Nessus Network Monitor	Web Servers		medium
11176	Apache Tomcat Catalina org.apache.catalina.servlets.DefaultServlet Source Code Disclosure	Nessus	CGI abuses	Remote	medium

Detections

Analytics

CVE-2002-1148

high

Tenable Plugins

high

high

medium

medium

medium