CVE-2003-0042
Jakarta Tomcat Directory Listing vulnerability
Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
Exploit likelihood
What each source reports
NVD Score used
Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
- Record
CVE-2003-0042- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
- Record
CVE-2003-0042- Updated
- 2026-11-02
EUVDEUVD-2022-1814 No score
Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
- Record
EUVD-2022-1814- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qfw2-wvrw-mvw4 No score
Jakarta Tomcat Directory Listing vulnerability
Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
- Record
GHSA-qfw2-wvrw-mvw4- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-qfw2-wvrw-mvw4 No score
Jakarta Tomcat Directory Listing vulnerability
Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
- Record
GHSA-qfw2-wvrw-mvw4- Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
before 3.3.1a | 3.3.1a |
tomcatDebian:3.0 |
before 3.3a-4woody.1, plus listed versions 3.3a-4woody1 |
3.3a-4woody.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Tomcat 3.x - Null Byte Directory / File Disclosure | 2003-01-26 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2003-0042 is a medium vulnerability (CVSS 5.0) in Apache Tomcat, published January 29, 2003. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 46.0%, the 98th percentile. Fixed in org.apache.tomcat:tomcat 3.3.1a.