CVE-2003-0043 json
Tomcat uses trusted privileges when processing web.xml file
published 2003-02-07 23 y ago modified 2026-06-16 4 mo ago also GHSA-cvx5-7vc7-rg77 , EUVD-2003-0041
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.5%
- EPSS 4.5% chance of exploitation in 30 days, percentile 91%
- public exploits
- 0
- none known
Summary
Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.
Patch / fix
- maven org.apache.tomcat:tomcat 3.3.1a
Exploit prediction
4.51% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.tomcat:tomcat | <3.3.1a |
3.3.1a |
Classification
- Weakness
-
- CWE-250 Execution with Unnecessary Privileges
References
-
debian.org
/security/2003/dsa-246
vendor-advisory, web
-
securityfocus.com
/advisories/5111
vendor-advisory
-
jakarta.apache.org
/builds/jakarta-tomcat/release/v3.3.1a/
vendor-advisory
-
jakarta.apache.org
/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
vendor-advisory
-
ciac.org
/ciac/bulletins/n-060.shtml
third-party-advisory, government-resource
-
securityfocus.com
/bid/6722
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/11195
vdb-entry, web
-
nvd.nist.gov
/vuln/detail/CVE-2003-0043
advisory
-
github.com
/apache/tomcat
package
-
web.archive.org
/web/20030804165204/http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
web
-
web.archive.org
/web/20030810045410/http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a
web
-
web.archive.org
/web/20030819144200/http://www.ciac.org/ciac/bulletins/n-060.shtml
web
-
web.archive.org
/web/20131213024606/http://www.securityfocus.com/bid/6722
web
-
web.archive.org
/web/20140627151430/http://www.securityfocus.com/advisories/5111
web
Sources
- CVE List CVE-2003-0043
- GitHub Advisory GHSA-cvx5-7vc7-rg77
- NVD CVE-2003-0043
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.