search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Apache Tomcat default installation contains sample applications that disclose webroot path

Vulnerability Note VU#116963

Original Release Date: 2002-06-11 | Last Revised: 2002-06-11


There is an insecure default configuration in Apache Tomcat web server that places several sample applications in the webroot. Remote users may be able to use these applications to gain sensitive information about the server's configuration.


There are several sample applications that ship with Apache Tomcat, and are installed in the webroot by default. If these applications are left in the webroot of a production machine, remote users may be able to gain sensitive information about the server's configuration.


A remote user may be able to gain sensitive information about the server's configuration.


The CERT/CC is currently unaware of a practical solution to this problem.

Remove the sample files prior to placing the server into production.

Vendor Information


Apache Affected

Notified:  May 16, 2002 Updated: June 10, 2002



Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector



Thanks to ProCheckUp for reporting this vulnerability.

This document was written by Jason A Rafail.

Other Information

CVE IDs: None
Severity Metric: 3.00
Date Public: 2002-05-29
Date First Published: 2002-06-11
Date Last Updated: 2002-06-11 20:32 UTC
Document Revision: 7

Sponsored by CISA.