CVE-2002-2007

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 41.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2002-12-31 · updated 2026-06-16

Description

The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages.

Affected products

Apache Tomcat: 3.2.3, 3.2.4

References

http://cert.uni-stuttgart.de/archive/bugtraq/2002/05/msg00272.html
http://cert.uni-stuttgart.de/archive/bugtraq/2002/05/msg00275.html
http://www.iss.net/security_center/static/9208.php
http://www.kb.cert.org/vuls/id/116963
http://www.procheckup.com/security_info/vuln_pr0205.html
http://www.procheckup.com/security_info/vuln_pr0206.html
http://www.procheckup.com/security_info/vuln_pr0207.html
http://www.securityfocus.com/bid/4876
http://www.securityfocus.com/bid/4877
http://www.securityfocus.com/bid/4878
http://cert.uni-stuttgart.de/archive/bugtraq/2002/05/msg00272.html
http://cert.uni-stuttgart.de/archive/bugtraq/2002/05/msg00275.html

Get alerted when CVE-2002-2007 or the next vulnerability affects your stack