Apache Tomcat 3/4 - 'DefaultServlet' File Disclosure

Author: Rossen Raykov
type: remote
platform: unix
port: 
date_added: 2002-09-24 
date_updated: 2012-10-09 
verified: 1 
codes: CVE-2002-1148;OSVDB-8773 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/5786/info

The servlet 'org.apache.catalina.servlets.DefaultServlet' is included with Apache Tomcat by default. It is possible to use this servlet to view contents of files within the webroot. This includes JSP source code, which may contain sensitive data such as database usernames and passwords.

http://target/admin/servlet/org.apache.catalina.servlets.DefaultServlet/target.jsp