Vulnerability Note VU#116963
Apache Tomcat default installation contains sample applications that disclose webroot path
There is an insecure default configuration in Apache Tomcat web server that places several sample applications in the webroot. Remote users may be able to use these applications to gain sensitive information about the server's configuration.
There are several sample applications that ship with Apache Tomcat, and are installed in the webroot by default. If these applications are left in the webroot of a production machine, remote users may be able to gain sensitive information about the server's configuration.
A remote user may be able to gain sensitive information about the server's configuration.
The CERT/CC is currently unaware of a practical solution to this problem.
Remove the sample files prior to placing the server into production.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Apache||Affected||16 May 2002||10 Jun 2002|
CVSS Metrics (Learn More)
Thanks to ProCheckUp for reporting this vulnerability.
This document was written by Jason A Rafail.
- CVE IDs: Unknown
- Date Public: 29 May 2002
- Date First Published: 11 Jun 2002
- Date Last Updated: 11 Jun 2002
- Severity Metric: 3.00
- Document Revision: 7
If you have feedback, comments, or additional information about this vulnerability, please send us email.