CVE-2002-2009 Apache Tomcat Leaks Pathname Information via Error Message

Q: Which versions are affected by CVE-2002-2009?

2 open source packages ship an affected version, including org.apache.tomcat:tomcat. It affects 1 product.

Q: Is CVE-2002-2009 being exploited?

There is no known exploitation of CVE-2002-2009 in the wild and no public exploit code.

Q: How do I fix CVE-2002-2009?

No fix has been published for CVE-2002-2009 yet. Limit exposure of the affected software until one is available.

Medium 5.0 Published 14 Jul 2005 Updated 8 Aug 2024

Remote attackers can obtain the web root path via crafted HTTP requests for JSP files, leaking sensitive pathname information in error messages.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2002-2009?

CVE-2002-2009 is a medium-severity vulnerability in Apache Tomcat, published on 14 Jul 2005. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message.

Which versions are affected by CVE-2002-2009?

2 open source packages ship an affected version, including org.apache.tomcat:tomcat. It affects 1 product.

Package	Affected	Fixed in
`org.apache.tomcat:tomcat` Maven	From `4.0.0` to `4.0.1`	None
`org.apache.tomcat:tomcat` Maven	From `4.0.0` to `4.0.1`	None

Products include Apache Tomcat.

How do I fix CVE-2002-2009?

No fix has been published for CVE-2002-2009 yet. Limit exposure of the affected software until one is available.

Is CVE-2002-2009 being exploited?

There is no known exploitation of CVE-2002-2009 in the wild and no public exploit code.

All Apache Tomcat vulnerabilities

Sources

Also known as GHSA-r6cf-cr44-m8rr.