CVE-2002-1394

highPriorität · verfolgen · 32EPSS 0.059 · 93. PerzentilEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

5.85% (93rd) EPSS

CVSS 7.5 · high

Is it mine?

14 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

enisa_euvd · nvd · osv · redhat_csaf

EPSS · bewertet 2026-10-27

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenStronghold 4 for Red Hat Enterprise Linuxredhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system.
https://access.redhat.com/errata/RHSA-2003:075
BehobenRed Hat Stronghold 4redhat_csaf
Fixed Stronghold 4 packages are now available via the update agent service; run $ bin/agent from the Stronghold 4 install root to upgrade an existing Stronghold 4 installation to the new package versions. After upgrading Stronghold, the server must be completely restarted by running the following commands from the install root: $ bin/stop-server $ bin/stop-tomcat $ bin/start-tomcat $ bin/start-server For more information on how to upgrade between releases of Stronghold 4, see http://stronghold.redhat.com/support/upgrade-sh4
https://access.redhat.com/errata/RHSA-2003:082

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.4–7.5

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 6.4

v2.06.4mediumAV:N/AC:L/Au:N/C:P/I:P/A:P/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-200US

betroffene Produkte (14)

Betroffene Produkte und Versionsbereiche.

n/a n/a≤ n/aenisa_euvdEU
apache tomcat= 4.0.0nvdUScpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
apache tomcat= 4.0.1nvdUScpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
apache tomcat= 4.0.2nvdUScpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
apache tomcat= 4.0.3nvdUScpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
apache tomcat= 4.0.4nvdUScpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
apache tomcat= 4.0.5nvdUScpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
apache tomcat= 4.1.0nvdUScpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
apache tomcat= 4.1.10nvdUScpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
apache tomcat= 4.1.3nvdUScpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
apache tomcat= 4.1.9nvdUScpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
Maven org.apache.tomcat:tomcat< 4.0.6osvUSpkg:maven/org.apache.tomcat/tomcat
Red Hat Stronghold 4alle Versionenfixedredhat_csafUScpe:/a:redhat:stronghold:4
Stronghold 4 for Red Hat Enterprise Linuxalle Versionenfixedredhat_csafUScpe:/a:redhat:rhel_stronghold:4

Advisories (3)

Hersteller- und Ökosystem-Meldungen dazu.

RHSA-2003:075Red Hat Security Advisory: tomcat security update for Stronghold2003-04-09csaf · redhat_csafUS
Updated tomcat packages are now available for Stronghold 4.0 to close a second JSP source code exposure vulnerability.
RHSA-2003:082Red Hat Security Advisory: apache, openssl, php, tomcat security update for Stronghold2003-03-03csaf · redhat_csafUS
Updated versions of Stronghold 4 cross-platform are available to fix a number of vulnerabilities in OpenSSL, Apache, PHP, and Tomcat. Also included in this update are bug fixes for mod_proxy and the mod_authz_ldap package.
GHSA-8v5p-2cpv-c2x6Apache Tomcat Source Code Disclosure2022-04-30ghsa · osvUS
Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.

auch bekannt als (2)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

enisa_euvd nvd osv redhat_csaf NVD CVE.org MITRE

veröffentlicht 2003-01-17geändert 2026-06-16

Referenzen (22)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan