Exploitation Summary
EIP tracks 3 public exploits for CVE-2002-2007. PoCs published by Richard Brain.
AI-analyzed exploit summary This is a writeup describing an information disclosure vulnerability in Apache Tomcat's default example JSP files. The vulnerability allows an attacker to retrieve the absolute path to the server's web root by requesting specific JSP files without input.
Description
The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages.
Exploits (3)
This is a writeup describing an information disclosure vulnerability in Apache Tomcat's default example JSP files. The vulnerability allows an attacker to retrieve the absolute path to the server's web root by requesting specific JSP files without input.
This is a writeup describing an information leakage vulnerability in Apache Tomcat where malformed requests to source.jsp can expose sensitive server configuration details, including the web root directory and potential directory listings.
The provided text describes an information leakage vulnerability in Apache Tomcat where accessing the realPath.jsp page discloses the web root directory. This is not a functional exploit but rather a description of the vulnerability and its impact.