CVE-2003-0042 - Vulnerability Details - OpenCVE

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.55831.

Key SSVC decision points have not yet been added.

Vendors	Products
Apache	Tomcat

Configuration 1 [-]

OR	cpe:2.3:a:apache:tomcat:3.0:::::::*
	cpe:2.3:a:apache:tomcat:3.1:::::::*
	cpe:2.3:a:apache:tomcat:3.1.1:::::::*
	cpe:2.3:a:apache:tomcat:3.2:::::::*
	cpe:2.3:a:apache:tomcat:3.2.1:::::::*
	cpe:2.3:a:apache:tomcat:3.2.3:::::::*
	cpe:2.3:a:apache:tomcat:3.2.4:::::::*
	cpe:2.3:a:apache:tomcat:3.3:::::::*
	cpe:2.3:a:apache:tomcat:3.3.1:::::::*

No data.

No data.

Advisories

Source	ID	Title
Github GHSA	GHSA-qfw2-wvrw-mvw4	Jakarta Tomcat Directory Listing vulnerability

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
http://marc.info/?l=bugtraq&m=104394568616290&w=2
http://secunia.com/advisories/7972
http://secunia.com/advisories/7977
http://www.ciac.org/ciac/bulletins/n-060.shtml
http://www.debian.org/security/2003/dsa-246
http://www.securityfocus.com/advisories/5111
http://www.securityfocus.com/bid/6721
https://exchange.xforce.ibmcloud.com/vulnerabilities/11194

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2003-01-29T05:00:00

Updated: 2024-08-08T01:43:35.163Z

Reserved: 2003-01-27T00:00:00

Link: CVE-2003-0042

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2003-02-07T05:00:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2003-0042

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2003-01-25T00:00:00", "descriptions": [{"lang": "en", "value": "Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-10T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "DSA-246", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2003/dsa-246"}, {"name": "6721", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/6721"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/"}, {"name": "20030130 Apache Jakarta Tomcat 3 URL parsing vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://marc.info/?l=bugtraq&m=104394568616290&w=2"}, {"name": "HPSBUX0303-249", "tags": ["vendor-advisory", "x_refsource_HP"], "url": "http://www.securityfocus.com/advisories/5111"}, {"name": "tomcat-null-directory-listing(11194)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11194"}, {"name": "N-060", "tags": ["third-party-advisory", "government-resource", "x_refsource_CIAC"], "url": "http://www.ciac.org/ciac/bulletins/n-060.shtml"}, {"name": "7977", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/7977"}, {"name": "7972", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/7972"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2003-0042", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "DSA-246", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2003/dsa-246"}, {"name": "6721", "refsource": "BID", "url": "http://www.securityfocus.com/bid/6721"}, {"name": "http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/", "refsource": "CONFIRM", "url": "http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/"}, {"name": "20030130 Apache Jakarta Tomcat 3 URL parsing vulnerability", "refsource": "BUGTRAQ", "url": "http://marc.info/?l=bugtraq&m=104394568616290&w=2"}, {"name": "HPSBUX0303-249", "refsource": "HP", "url": "http://www.securityfocus.com/advisories/5111"}, {"name": "tomcat-null-directory-listing(11194)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11194"}, {"name": "N-060", "refsource": "CIAC", "url": "http://www.ciac.org/ciac/bulletins/n-060.shtml"}, {"name": "7977", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/7977"}, {"name": "7972", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/7972"}, {"name": "http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt", "refsource": "CONFIRM", "url": "http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-08T01:43:35.163Z"}, "title": "CVE Program Container", "references": [{"name": "DSA-246", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2003/dsa-246"}, {"name": "6721", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/6721"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/"}, {"name": "20030130 Apache Jakarta Tomcat 3 URL parsing vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=104394568616290&w=2"}, {"name": "HPSBUX0303-249", "tags": ["vendor-advisory", "x_refsource_HP", "x_transferred"], "url": "http://www.securityfocus.com/advisories/5111"}, {"name": "tomcat-null-directory-listing(11194)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11194"}, {"name": "N-060", "tags": ["third-party-advisory", "government-resource", "x_refsource_CIAC", "x_transferred"], "url": "http://www.ciac.org/ciac/bulletins/n-060.shtml"}, {"name": "7977", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/7977"}, {"name": "7972", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/7972"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2003-0042", "datePublished": "2003-01-29T05:00:00", "dateReserved": "2003-01-27T00:00:00", "dateUpdated": "2024-08-08T01:43:35.163Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:*", "matchCriteriaId": "BAFF8D91-80A2-454A-8B44-A5A889002692", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:3.1:*:*:*:*:*:*:*", "matchCriteriaId": "FEC42876-65AD-476A-8B62-25D4E15D1BB6", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:3.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "724A8FF9-8089-4302-8200-08987A712988", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:3.2:*:*:*:*:*:*:*", "matchCriteriaId": "3F97DDB7-E32B-422F-8AEA-07C75DEAD36E", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:3.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "7079F63C-7CA8-4909-A9C8-45C4C1C1C186", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:3.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "EC829C8E-1061-4F62-BA4B-FE5C7F11F209", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:3.2.4:*:*:*:*:*:*:*", "matchCriteriaId": "143BA75E-A186-47EF-A18C-B1A1A1F61C00", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:3.3:*:*:*:*:*:*:*", "matchCriteriaId": "C0CDF9E1-9412-450E-B1D4-438F128FFF9E", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:3.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "32561F50-6385-4D71-AFAC-3D2F8DB55A4B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character."}, {"lang": "es", "value": "Jakarta Tomcat antes de 3.3.1a, cuando se usa con JDK 1.3.1 o anterior, permite a atacantes remotos listar directorios incluso cuando un index.html u otro fichero presente mediante una URL conteniendo un car\u00e1cter nulo."}], "id": "CVE-2003-0042", "lastModified": "2025-04-03T01:03:51.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2003-02-07T05:00:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt"}, {"source": "cve@mitre.org", "url": "http://marc.info/?l=bugtraq&m=104394568616290&w=2"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/7972"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/7977"}, {"source": "cve@mitre.org", "url": "http://www.ciac.org/ciac/bulletins/n-060.shtml"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.debian.org/security/2003/dsa-246"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/advisories/5111"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/6721"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11194"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=bugtraq&m=104394568616290&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/7972"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/7977"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.ciac.org/ciac/bulletins/n-060.shtml"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.debian.org/security/2003/dsa-246"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/advisories/5111"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/6721"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11194"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}