Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-qfw2-wvrw-mvw4
Advisory ID github_osv/GHSA-qfw2-wvrw-mvw4
Aliases CVE-2003-0042
Summary Jakarta Tomcat Directory Listing vulnerability Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a
http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
http://marc.info/?l=bugtraq&m=104394568616290&w=2
http://secunia.com/advisories/7972
http://secunia.com/advisories/7977
https://exchange.xforce.ibmcloud.com/vulnerabilities/11194
https://github.com/apache/tomcat
http://www.ciac.org/ciac/bulletins/n-060.shtml
http://www.debian.org/security/2003/dsa-246
http://www.securityfocus.com/advisories/5111
http://www.securityfocus.com/bid/6721
CVE-2003-0042 https://nvd.nist.gov/vuln/detail/CVE-2003-0042
Data source Exploit-DB
Date added Jan. 26, 2003
Description Apache Tomcat 3.x - Null Byte Directory / File Disclosure
Ransomware campaign use Known
Source publication date Jan. 26, 2003
Exploit type remote
Platform linux
Source update date Oct. 24, 2012
Source URL https://www.securityfocus.com/bid/6721/info

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.