CVE-2003-0042: Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list director...

Security readout for executives and security teams

This is an old Apache Jakarta Tomcat 3 issue that can expose directory contents or JSP source code when Tomcat runs with JDK 1.3.1 or earlier. The business risk is unintended disclosure of application logic, credentials, or internal paths from legacy web servers. Exposure is most likely in legacy environments still running Jakarta Tomcat 3.x before 3.3.1a with JDK 1.3.1 or earlier, especially if reachable from the internet or internal untrusted networks. Prioritize remediation if any affected service is reachable outside a tightly controlled network. The vulnerability can disclose source code and directory contents, which may expose secrets or accelerate further compromise. Mitigation focus: Upgrade affected Tomcat deployments to 3.3.1a or a vendor-supported fixed package.; Retire unsupported Tomcat 3.x and JDK 1.3.1-or-earlier stacks where found.; Restrict network access to any legacy Tomcat service pending remediation..

Prepared

Jul 1, 2026, 06:00 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.