vendor:
Tomcat
by:
SecurityFocus
7.5
CVSS
HIGH
Information Disclosure
200
CWE
Product Name: Tomcat
Affected Version From: Apache Tomcat 4.0.1
Affected Version To: Apache Tomcat 4.1.12
Patch Exists: YES
Related CWE: N/A
CPE: a:apache:tomcat
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2002
DefaultServlet Information Disclosure Vulnerability
The servlet 'org.apache.catalina.servlets.DefaultServlet' is included with Apache Tomcat by default. It is possible to use this servlet to view contents of files within the webroot. This includes JSP source code, which may contain sensitive data such as database usernames and passwords.
Mitigation:
Restrict access to the servlet by using a web application firewall or by configuring the servlet to only accept requests from trusted IP addresses.
