CVE-2002-1567

CVE-2002-1567 describes a cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1. This flaw allows remote attackers to inject and execute arbitrary web scripts, potentially leading to cookie theft, by crafting a malicious URL containing encoded newlines followed by a request to a JSP file whose name embeds the script. With a CVSS score of 6.8 and a FAUCET Risk Score of 97/100, this vulnerability is considered moderately severe due to its network-based attack vector and medium complexity, enabling partial impact to confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, exploit code is publicly available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion or media coverage.