org.apache.tomcat CVEs · Mitigation candidate

VRT Sign in

Look up CVE IDs Status Exploitation Severity

Reset

Overview 3 matches · 0 protected · 0 exploited · 0 CISA KEV · 0 EPSS ≥ 0.5

3matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0EPSS ≥ 0.50.0%

Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 3 100.0% No exploit published 0 0.0%

Critical 0 0.0% High 0 0.0% Medium 3 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 3 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 3 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%

split by StatusSeverityProtectionExploit maturity peak 1 / quarter

Q4 001 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 Q1 010 Q2 010 Q3 011 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 Q4 010 Q1 020 Q2 020 Q3 020 Q4 021 Mitigation candidate1 Medium1 not blocked1 Working exploit published1

Q4 00Q1 01Q2 01Q3 01Q4 01Q1 02Q2 02Q3 02Q4 02

3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2002-1148	Medium	2002-10-11	Mitigation candidate	Working exploit published	The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.
CVE-2001-0590	Medium	2001-08-02	Mitigation candidate	Working exploit published	Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).
CVE-2000-0759	Medium	2000-10-20	Mitigation candidate	Working exploit published	Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2002-1148

Medium

2002-10-11

Mitigation candidate

Working exploit published

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

CVE-2001-0590

Medium

2001-08-02

Mitigation candidate

Working exploit published

Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).

CVE-2000-0759

Medium

2000-10-20

Mitigation candidate

Working exploit published

Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.