Skip to content
OpenAdvisories
Unscored DSA-246 3 CVEs

tomcat - information exposure, cross site scripting

Published Jan 29, 2003 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 3.0 tomcat 3.3a-4woody.1

Vulnerabilities 3

  • Medium —
    CVE-2003-0042 Public exploit EPSS 46%

    Jakarta Tomcat Directory Listing vulnerability

    Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2003-0043

    Tomcat uses trusted privileges when processing web.xml file

    Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2003-0044

    Jakarta Tomcat cross-site scripting (XSS) vulnerability

    Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.

    org.apache.tomcat:tomcat Maven