Skip to content
OpenAdvisories
Unscored DSA-225 1 CVE

tomcat4 - source disclosure

Published Jan 9, 2003 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 3.0 tomcat4 4.0.3-3woody2

Vulnerabilities 1

  • High —
    CVE-2002-1394

    Apache Tomcat Source Code Disclosure

    Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.

    org.apache.tomcat:tomcat Maven