Rapid7 Vulnerability & Exploit Database

Apache Tomcat 4.x Device Name Web Root Disclosure

Back to Search

Apache Tomcat 4.x Device Name Web Root Disclosure

Severity
5
CVSS
(AV:N/AC:L/Au:N/C:P/I:N/A:N)
Published
12/31/2002
Created
07/25/2018
Added
11/01/2004
Modified
12/04/2013

Description

By sending a specially formatted request that contains a special DOS device name (such as "LPT9"), it is possible to cause Apache Tomcat running on Windows to reveal the full path of the web server's root. An attacker can use this vulnerability to gain information about the layout of the server filesystem, possibly aiding other attacks.

Solution(s)

  • tomcat-4x-upgrade-4_1_3
  • tomcat-4x-upgrade-latest

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;