CVE-2002-2008
Apache Tomcat Leaks Information via Error Message
Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message.
Exploit likelihood
What each source reports
NVD Score used
Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message.
- Record
CVE-2002-2008- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message.
- Record
CVE-2002-2008- Updated
- 2026-11-02
EUVDEUVD-2002-1987 No score
Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message.
- Record
EUVD-2002-1987- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m8w6-7rh6-4xj6
Apache Tomcat Leaks Information via Error Message
Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message.
- Record
GHSA-m8w6-7rh6-4xj6- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-209
- Updated
- 2026-11-02
OSVGHSA-m8w6-7rh6-4xj6
Apache Tomcat Leaks Information via Error Message
Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message.
- Record
GHSA-m8w6-7rh6-4xj6- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-209
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
before 4.1.3 | 4.1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2002-2008 is a medium vulnerability (CVSS 5.0) in Apache Tomcat, published December 31, 2002. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.11%, the 94th percentile. Fixed in org.apache.tomcat:tomcat 4.1.3.
References
tomcat.apache.org/security-4.html
securityfocus.com/bid/5054
iss.net/security_center/static/9394.php
archives.neohapsis.com/archives/bugtraq/2002-06/0225.html
lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2002-2008
web.archive.org/web/20200815000000*/http://www.securityfocus.com/bid/5054
github.com/advisories/GHSA-m8w6-7rh6-4xj6