The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to
    obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2)
    TroubleShooter example servlets. (CVE-2002-2006)

According to its self-reported version number, the instance of Apache Tomcat 4.x listening on the remote host is prior to 4.1.0. It is, therefore, affected by multiple vulnerabilities :

  - An error exists in the handling of malformed packets     that can cause the processing thread to become     unresponsive. A sequence of such requests can cause all     threads to become unresponsive. (CVE-2003-0866)

  - Two example servlets, 'snoop' and a troubleshooting     servlet, disclose the Apache Tomcat installation path.
    (CVE-2002-2006)

  - It has also been reported that this version of Tomcat     is affected by a cross-site scripting vulnerability.
    The contents of a request URL are not sanitized before     being returned to the browser should an error occur.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The default installation of Apache Tomcat includes various sample JSP pages and servlets.  One of these, the 'TroubleShooter' servlet, discloses Tomcat's installation directory when accessed directly.

ID	Name	Product	Family	Type	Severity
433770	SCA: security update for org.apache.tomcat:tomcat (GHSA-8g4f-fh7f-4fwh)	Tenable Cloud Security	SCA Checks	Local	high
433770	SCA: security update for org.apache.tomcat:tomcat (GHSA-8g4f-fh7f-4fwh)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
50475	Apache Tomcat 4.x < 4.1.0 Multiple Vulnerabilities	Nessus	Web Servers	Combined	medium
11046	Apache Tomcat TroubleShooter Servlet Information Disclosure	Nessus	CGI abuses	Remote	medium

Detections

Analytics

CVE-2002-2006

high

Tenable Plugins

high

high

medium

medium