{"id":"CVE-2003-0043","aliases":["DSA-246","EUVD-2003-0041","GHSA-cvx5-7vc7-rg77"],"status":"published","title":"Tomcat uses trusted privileges when processing web.xml file","description":"Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04514,"percentile":0.91583,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-250"],"published":"2003-01-29T00:00:00Z","modified":"2026-06-16T22:01:24Z","fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","fixed_in":["3.3.1a"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1a"}]}]},{"source":"osv","ecosystem":"Debian:3.0","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3a-4woody.1"}]}],"versions":["3.3a-4woody1"],"bundled":3},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1a"}]}]}],"products":[{"vendor":"apache","product":"tomcat"}],"references":[{"url":"http://www.debian.org/security/2003/dsa-246","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","web"]},{"url":"http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/advisories/5111","tags":["vendor-advisory","x_refsource_HP","x_transferred"]},{"url":"http://www.ciac.org/ciac/bulletins/n-060.shtml","tags":["third-party-advisory","government-resource","x_refsource_CIAC","x_transferred"]},{"url":"http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/6722","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/11195","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2003-0043","tags":["advisory"]},{"url":"https://web.archive.org/web/20030804165204/http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt","tags":["web"]},{"url":"https://web.archive.org/web/20030810045410/http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a","tags":["web"]},{"url":"https://web.archive.org/web/20030819144200/http://www.ciac.org/ciac/bulletins/n-060.shtml","tags":["web"]},{"url":"https://web.archive.org/web/20131213024606/http://www.securityfocus.com/bid/6722","tags":["web"]},{"url":"https://web.archive.org/web/20140627151430/http://www.securityfocus.com/advisories/5111","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cvx5-7vc7-rg77"},{"url":"https://github.com/apache/tomcat","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2003-0043","description":"Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.","status":"published","published":"2004-09-01T04:00:00Z","modified":"2024-08-08T01:43:34.892Z","updated_at":"2026-11-02T14:20:16.757505Z"}],"euvd":[{"id":"EUVD-2003-0041","description":"Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.","status":"published","published":"2004-09-01T04:00:00Z","modified":"2024-08-08T01:43:34Z","updated_at":"2026-11-03T01:15:09.127613Z"}],"ghsa":[{"id":"GHSA-cvx5-7vc7-rg77","title":"Tomcat uses trusted privileges when processing web.xml file","description":"Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.","status":"published","published":"2022-04-29T01:25:44Z","modified":"2025-04-03T15:12:17Z","cwes":["CWE-250"],"updated_at":"2026-11-02T14:38:37.325334Z"}],"nvd":[{"id":"CVE-2003-0043","description":"Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.","status":"published","published":"2003-02-07T05:00:00Z","modified":"2026-06-16T22:01:24.337Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:00:46.710758Z"}],"osv":[{"id":"DSA-246","title":"tomcat - information exposure, cross site scripting","status":"published","published":"2003-01-29T00:00:00Z","modified":"2026-03-09T01:21:34.030287Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"GHSA-cvx5-7vc7-rg77","title":"Tomcat uses trusted privileges when processing web.xml file","description":"Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.","status":"published","published":"2022-04-29T01:25:44Z","modified":"2025-04-03T15:42:10.869033Z","cwes":["CWE-250"],"updated_at":"2026-11-02T15:46:45.639885Z"}]}}