$ cve CVE-2002-2007 JSON

CVE-2002-2007 EXPLOIT

5.0

MEDIUM · CVSS 2.0 · EPSS 41.4% (pctl 99)

Patch early

A public exploit exists.

Description

The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages.

Scoring

CVSS	5.0 (MEDIUM, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS	41.4% — more likely to be exploited than 99% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2002-12-31
Last modified	2026-06-16

Affected (1)

Vendor	Product
apache	tomcat

Public exploits

Source	Title	Date
exploit-db	Apache Tomcat 3.2.3/3.2.4 - 'Source.jsp' Information Disclosure	2002-05-29
exploit-db	Apache Tomcat 3.2.3/3.2.4 - Example Files Web Root Full Path Disclosure	2002-05-29
exploit-db	Apache Tomcat 3.2.3/3.2.4 - 'RealPath.jsp' Information Disclosuree	2002-05-29

References

→ the Explorer · watch your stack · NVD