CVE catalog
CVE-2002-1394
tomcat4 - source disclosure
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 5.85% · Oct 25, 2026
Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148. security flaw
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | tomcat4 | 3.0 | 4.0.3-3woody2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | tomcat4 | deb | 3.0 | 4.0.3-3woody2 | Not reported | DSA-225 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed: