Apache Tomcat RealPath.JSP Malformed Request Information Disclosure Vulnerability
BID:4878
Info
Apache Tomcat RealPath.JSP Malformed Request Information Disclosure Vulnerability
| Bugtraq ID: | 4878 |
| Class: | Configuration Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 29 2002 12:00AM |
| Updated: | May 29 2002 12:00AM |
| Credit: | Discovery is credited to Richard Brain. |
| Vulnerable: |
Apache Tomcat 3.2.4 Apache Tomcat 3.2.3 |
| Not Vulnerable: | |
Discussion
Apache Tomcat RealPath.JSP Malformed Request Information Disclosure Vulnerability
Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation.
Under some circumstances, Tomcat may yield sensitive information about the web server configuration. When the realPath.jsp page is accessed, it may leak information. Upon being accessed, the realPath.jsp page will display the web root directory of the Tomcat implementation.
Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation.
Under some circumstances, Tomcat may yield sensitive information about the web server configuration. When the realPath.jsp page is accessed, it may leak information. Upon being accessed, the realPath.jsp page will display the web root directory of the Tomcat implementation.
Exploit / POC
Apache Tomcat RealPath.JSP Malformed Request Information Disclosure Vulnerability
This vulnerability may be exploited with a web browser. The following proof of concept has been provided:
http://example.com/test/realPath.jsp
This vulnerability may be exploited with a web browser. The following proof of concept has been provided:
http://example.com/test/realPath.jsp
Solution / Fix
Apache Tomcat RealPath.JSP Malformed Request Information Disclosure Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.