CVE-2002-1148 — AI Deep Analysis Summary

🚨 **What is this vulnerability?** * **Essence:** A critical file disclosure flaw in Apache Tomcat's `DefaultServlet`. * **Consequences:** Remote attackers can directly request the controller and **read server-side s…

🛡️ **Root Cause? (CWE/Flaw)** * **Flaw:** Improper access control in the default servlet configuration. * **CWE:** Not explicitly mapped in the provided data, but effectively an **Information Exposure** issue. * *…

📦 **Who is affected? (Versions/Components)** * **Product:** Apache Tomcat. * **Affected Versions:** * Tomcat **4.0.4** * Tomcat **4.1.10** * **All versions prior** to these specific releases. * *…

💻 **What can hackers do? (Privileges/Data)** * **Action:** Send direct HTTP requests to the `DefaultServlet`. * **Result:** Retrieve **plaintext source code** of the application. * **Data Type:** Confidential inte…

🔓 **Is exploitation threshold high? (Auth/Config)** * **Threshold:** **LOW**. * **Authentication:** None required. It is a **remote** attack. * **Configuration:** Exploits the *default* controller behavior.…

🧪 **Is there a public Exp? (PoC/Wild Exploitation)** * **Status:** **YES**. * **Evidence:** Multiple mailing list discussions (Bugtraq, Tomcat-dev) from 2002 confirm source code exposure. * **References:** Debian …

🔍 **How to self-check? (Features/Scanning)** * **Method:** Target the `DefaultServlet` endpoint directly. * **Test:** Request a known `.jsp` or `.java` file path via the servlet. * **Indicator:** If the server ret…

🩹 **Is it fixed officially? (Patch/Mitigation)** * **Status:** **YES**. * **Fix:** Upgrading to **Tomcat 4.0.5+** or **4.1.11+** (implied by the "and prior versions" note). * **Official Docs:** Apache Tomcat site …

🚧 **What if no patch? (Workaround)** * **Immediate Action:** **Disable** or **restrict** access to the `DefaultServlet`. * **Config Change:** Modify `web.xml` to remove the `DefaultServlet` mapping or restrict it to…

⚡ **Is it urgent? (Priority Suggestion)** * **Priority:** **HIGH** (for legacy systems). * **Reason:** Source code leakage is a critical security failure. * **Note:** While Tomcat 4.x is ancient, if still in use, …