Vulnerability Details : CVE-2002-1394
Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.
Products affected by CVE-2002-1394
- cpe:2.3:a:apache:tomcat:4.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.3:beta:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.9:beta:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.10:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.0.5:*:*:*:*:*:*:*
Threat overview for CVE-2002-1394
Top countries where our scanners detected CVE-2002-1394
Top open port discovered on systems with this issue
80
IPs affected by CVE-2002-1394 235
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2002-1394!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2002-1394
0.26%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 63 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2002-1394
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
References for CVE-2002-1394
-
http://marc.info/?l=bugtraq&m=103470282514938&w=2
'GLSA: tomcat' - MARC
-
https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E
svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/-Apache Mail Archives
-
https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E
Apache Mail Archives
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/10376
Apache Tomcat invoker servlet used in conjunction with the default servlet reveals source code CVE-2002-1394 Vulnerability Report
-
http://www.debian.org/security/2003/dsa-225
-
https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E
svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/-Apache Mail Archives
-
http://www.redhat.com/support/errata/RHSA-2003-075.html
-
http://www.securityfocus.com/bid/6562
-
http://issues.apache.org/bugzilla/show_bug.cgi?id=13365
13365 – JSP source disclosure vulnerability not fixed when invoking servlets by name
-
http://marc.info/?l=tomcat-dev&m=103417249325526&w=2
'[SECURITY] Apache Tomcat 4.x JSP source disclosure vulnerability;' - MARC
-
http://www.redhat.com/support/errata/RHSA-2003-082.html
Support
Jump to