Apache Tomcat 3/4 - 'DefaultServlet' File Disclosure

EDB-ID:

21853




Platform:

Unix

Date:

2002-09-24


source: https://www.securityfocus.com/bid/5786/info

The servlet 'org.apache.catalina.servlets.DefaultServlet' is included with Apache Tomcat by default. It is possible to use this servlet to view contents of files within the webroot. This includes JSP source code, which may contain sensitive data such as database usernames and passwords.

http://target/admin/servlet/org.apache.catalina.servlets.DefaultServlet/target.jsp