Moderate severityNVD Advisory· Published Oct 11, 2002· Updated Apr 16, 2026
CVE-2002-1148
CVE-2002-1148
Description
The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.tomcat:tomcatMaven | >= 4.0.0, < 4.0.5 | 4.0.5 |
org.apache.tomcat:tomcatMaven | >= 4.1.0, < 4.1.12 | 4.1.12 |
Affected products
20cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:*+ 18 more
- cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:3.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:3.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:3.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:3.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:3.2.2:beta2:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:3.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:3.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:3.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:3.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.10:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.3:beta:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:4.1.9:beta:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
21- www.securityfocus.com/bid/5786nvdExploitPatchVendor Advisory
- www.iss.net/security_center/static/10175.phpnvdVendor Advisory
- github.com/advisories/GHSA-jxcv-v856-j5vgghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2002-1148ghsaADVISORY
- marc.infonvdWEB
- lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3EghsaWEB
- lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3EghsaWEB
- lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3EghsaWEB
- web.archive.org/web/20021027204137/http://www.iss.net/security_center/static/10175.phpghsaWEB
- web.archive.org/web/20030113141130/http://online.securityfocus.com/advisories/4758ghsaWEB
- web.archive.org/web/20030710185447/http://www.securityfocus.com/bid/5786ghsaWEB
- web.archive.org/web/20040814165854/http://rhn.redhat.com/errata/RHSA-2002-217.htmlghsaWEB
- web.archive.org/web/20040817035804/http://rhn.redhat.com/errata/RHSA-2002-218.htmlghsaWEB
- web.archive.org/web/20070430075037/http://www.debian.org/security/2002/dsa-170ghsaWEB
- online.securityfocus.com/advisories/4758nvd
- www.debian.org/security/2002/dsa-170nvd
- www.redhat.com/support/errata/RHSA-2002-217.htmlnvd
- www.redhat.com/support/errata/RHSA-2002-218.htmlnvd
- lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3Envd
- lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3Envd
- lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3Envd
News mentions
0No linked articles in our index yet.