CVE-2002-1394: Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote...

Security readout for executives and security teams

This is a legacy Apache Tomcat issue. If Tomcat 4.0.5 or earlier is configured with both the invoker servlet and default servlet, a remote attacker may read server-side source files or bypass some protections. The main business risk is sensitive code or configuration exposure from obsolete internet-facing systems. Exposure is most likely in old, unmanaged Java web applications still running Apache Tomcat 4.0.5 or earlier with the invoker servlet and default servlet enabled. Modern Tomcat deployments are unlikely to be affected unless obsolete components remain in production, staging, or forgotten internet-facing systems. Medium priority unless an affected Tomcat instance is internet-facing or hosts sensitive code. The vulnerability is old and not KEV-listed, but obsolete web stacks often escape normal patch processes and can expose credentials, business logic, or internal architecture. Mitigation focus: Identify and retire Apache Tomcat 4.0.5 or earlier deployments.; Apply vendor-supported Tomcat package updates from Apache or OS distributors.; Review vendor advisories before relying on configuration-only mitigation..

Prepared

Jun 30, 2026, 03:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.