CVE-2002-2009
published 2002-12-31CVE-2002-2009: Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which…
PriorityP416medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
7.31%
93.7th percentile
Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Tomcat Leaks Pathname Information via Error Message
ghsa·2022-04-30
CVE-2002-2009 [MEDIUM] CWE-209 Apache Tomcat Leaks Pathname Information via Error Message
Apache Tomcat Leaks Pathname Information via Error Message
Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message.
OSV
Apache Tomcat Leaks Pathname Information via Error Message
osv·2022-04-30
CVE-2002-2009 [MEDIUM] Apache Tomcat Leaks Pathname Information via Error Message
Apache Tomcat Leaks Pathname Information via Error Message
Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message.
Red Hat
CVE-2009-0653: OpenSSL, probably 0
vendor_redhat·CVSS 7.5
CVE-2009-0653 [HIGH] CVE-2009-0653: OpenSSL, probably 0
OpenSSL, probably 0.9.6, does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack, a related issue to CVE-2002-0970.
Statement: Not vulnerable. This issue was addressed in upstream OpenSSL prior to 0.9.6 and therefore does not affect the versions of OpenSSL as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.
No detection rules found.
No writeups or analysis indexed.
http://tomcat.apache.org/security-4.htmlhttp://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2002-04/0286.htmlhttp://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2002-04/0297.htmlhttp://www.securityfocus.com/bid/4557https://exchange.xforce.ibmcloud.com/vulnerabilities/42915https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3Ehttp://tomcat.apache.org/security-4.htmlhttp://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2002-04/0286.htmlhttp://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2002-04/0297.htmlhttp://www.securityfocus.com/bid/4557https://exchange.xforce.ibmcloud.com/vulnerabilities/42915https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E
2002-12-31
Published