CVE-2003-0042 json
Jakarta Tomcat Directory Listing vulnerability
published 2003-01-29 23 y ago modified 2026-06-16 4 mo ago also GHSA-qfw2-wvrw-mvw4 , EUVD-2022-1814
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 46.0%
- EPSS 46.0% chance of exploitation in 30 days, percentile 98%
- public exploits
- 1
- Exploit-DB
Summary
Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
Patch / fix
Timeline
- First public exploit (EDB-22205)
- Published
Exploit prediction
46.03% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-22205 Apache Tomcat 3.x - Null Byte Directory / File Disclosure remote, 2003-01-26
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.tomcat:tomcat | <3.3.1a |
3.3.1a |
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
debian.org
/security/2003/dsa-246
vendor-advisory, web, patch
-
securityfocus.com
/advisories/5111
vendor-advisory, web
-
jakarta.apache.org
/builds/jakarta-tomcat/release/v3.3.1a/
vendor-advisory
-
jakarta.apache.org
/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
web, vendor-advisory
-
securityfocus.com
/bid/6721
vdb-entry, web
-
marc.info
/?l=bugtraq&m=104394568616290&w=2
mailing-list, web
-
exchange.xforce.ibmcloud.com
/vulnerabilities/11194
vdb-entry, web
-
ciac.org
/ciac/bulletins/n-060.shtml
third-party-advisory, government-resource, web
-
secunia.com
/advisories/7977
third-party-advisory, web
-
secunia.com
/advisories/7972
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2003-0042
advisory
-
github.com
/apache/tomcat
package
-
jakarta.apache.org
/builds/jakarta-tomcat/release/v3.3.1a
web
Sources
- CVE List CVE-2003-0042
- GitHub Advisory GHSA-qfw2-wvrw-mvw4
- NVD CVE-2003-0042
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.