CVE-2002-2009

CVE-2002-2009 describes a vulnerability in Apache Tomcat 4.0.1 where remote attackers can discover the web root path. By sending HTTP requests for JSP files with specific malformed prefixes (e.g., "+/", ">/", "</", "%20/"), the server leaks the pathname in an error message. This vulnerability has a CVSS score of 5.0, indicating a medium severity, as it allows for information disclosure (Confidentiality impact: Partial) with a network attack vector and low attack complexity. While there is no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB) is unavailable, and it is not listed on the KEV catalog. Despite the lack of active exploitation, the vulnerability has garnered significant community discussion with 10 mentions, placing it in the top 1% of all CVEs for community attention.