Skip to content
OpenAdvisories
Unscored DSA-170 1 CVE

tomcat4 - source code disclosure

Published Oct 4, 2002 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 3.0 tomcat4 4.0.3-3woody1

Vulnerabilities 1

  • Medium —
    CVE-2002-1148 Public exploit EPSS 19%

    Apache Tomcat Source Code Disclosure

    The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

    org.apache.tomcat:tomcat Maven