CVE-2003-0042
Jakarta Tomcat Directory Listing vulnerability
CVE-2003-0042 is a medium vulnerability (CVSS 5.0) in Apache Tomcat, published January 29, 2003. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 46.0%, the 98th percentile. Fixed in org.apache.tomcat:tomcat 3.3.1a.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 46.0%EPSS, 98th percentile
- Exploitation
- None known1 public exploit
- Fixed in
3.3.1aorg.apache.tomcat:tomcat +1 more
Description
Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven | before 3.3.1a | 3.3.1a |
tomcatDebian:3.0 From an advisory covering 3 CVEs | before 3.3a-4woody.1, plus listed versions 3.3a-4woody1 | 3.3a-4woody.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Tomcat 3.x - Null Byte Directory / File Disclosure | 2003-01-26 |
What each source reports
NVD Score used
Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
- Record
CVE-2003-0042- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE ListNo score
Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
- Record
CVE-2003-0042- Updated
- 2026-11-02
EUVDEUVD-2022-1814No score
Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
- Record
EUVD-2022-1814- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qfw2-wvrw-mvw4No score
Jakarta Tomcat Directory Listing vulnerability
Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
- Record
GHSA-qfw2-wvrw-mvw4- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-qfw2-wvrw-mvw4No score
Jakarta Tomcat Directory Listing vulnerability
Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
- Record
GHSA-qfw2-wvrw-mvw4- Weakness
- CWE-22
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.