CVE-2002-1567
Apache Tomcat XSS Vulnerability
CVE-2002-1567 is a medium vulnerability (CVSS 6.8) in Apache Tomcat, published September 19, 2003. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 27.1%, the 98th percentile. Fixed in org.apache.tomcat:tomcat 4.1.29.
- Severity
- 6.8 MediumCVSS 2.0, NVD
- Exploit chance
- 27.1%EPSS, 98th percentile
- Exploitation
- None known1 public exploit
- Fixed in
4.1.29org.apache.tomcat:tomcat
Description
Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven | 4.1.0 up to 4.1.29 | 4.1.29 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Tomcat 4.1 - JSP Request Cross-Site Scripting | 2002-08-21 |
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.
- Record
CVE-2002-1567- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.
- Record
CVE-2002-1567- Updated
- 2026-11-02
EUVDEUVD-2022-1673No score
Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.
- Record
EUVD-2022-1673- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-86fp-jgwm-wgj5No score
Apache Tomcat XSS Vulnerability
Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.
- Record
GHSA-86fp-jgwm-wgj5- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-86fp-jgwm-wgj5No score
Apache Tomcat XSS Vulnerability
Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.
- Record
GHSA-86fp-jgwm-wgj5- Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
tomcat.apache.org/security-4.html
archives.neohapsis.com/archives/vuln-dev/2002-q3/0482.html
lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2002-1567
Show 5 moreShow less
web.archive.org/web/20041213160616/http://archives.neohapsis.com/archives/vuln-dev/2002-q3/0482.html
github.com/advisories/GHSA-86fp-jgwm-wgj5