CVE-2002-2007 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	29.78%	–	–
2022-04-03	–	–	29.78%	–	–
2023-03-12	–	–	–	0.31%	–
2023-03-26	–	–	–	0.25%	–
2023-06-04	–	–	–	0.3%	–
2023-09-03	–	–	–	0.3%	–
2023-11-05	–	–	–	0.26%	–
2024-02-11	–	–	–	2.47%	–
2024-03-17	–	–	–	3.08%	–
2024-06-02	–	–	–	3.7%	–
2024-06-02	–	–	–	3.7%	–
2024-08-11	–	–	–	3.35%	–
2024-08-25	–	–	–	3.35%	–
2024-09-22	–	–	–	0.25%	–
2024-12-22	–	–	–	0.35%	–
2025-01-19	–	–	–	0.35%	–
2025-03-18	–	–	–	–	22.34%
2025-03-30	–	–	–	–	22.61%
2025-05-01	–	–	–	–	22.61%
2025-05-04	–	–	–	–	22.61%
2025-05-04	–	–	–	–	22.61,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	96%
2022-04-03	97%
2023-03-12	65%
2023-03-26	62%
2023-06-04	65%
2023-09-03	66%
2023-11-05	64%
2024-02-11	9%
2024-03-17	91%
2024-06-02	92%
2024-06-02	92%
2024-08-11	91%
2024-08-25	92%
2024-09-22	65%
2024-12-22	72%
2025-01-19	72%
2025-03-18	95%
2025-03-30	95%
2025-05-01	96%
2025-05-04	95%
2025-05-04	95%

source: https://www.securityfocus.com/bid/4878/info Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation. Under some circumstances, Tomcat may yield sensitive information about the web server configuration. When the realPath.jsp page is accessed, it may leak information. Upon being accessed, the realPath.jsp page will display the web root directory of the Tomcat implementation. http://example.com/test/realPath.jsp

source: https://www.securityfocus.com/bid/4876/info Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation. Under some circumstances, Tomcat may yield sensitive information about the web server configuration. When the source.jsp page is passed a malformed request, it may leak information. This information may include the web root directory, and possibly a directory listing. http://example.com:80/examples/jsp/source.jsp?? http://example.com:80/examples/jsp/source.jsp?/jsp/

source: https://www.securityfocus.com/bid/4877/info Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation. When Apache Tomcat is installed with a default configuration, several example files are also installed. When some of these example files are requested without any input, they will return an error containing the absolute path to the server's web root. The attacker can submit a request in one of the following formats: http://webserver/test/jsp/pageInfo.jsp http://webserver/test/jsp/pageImport2.jsp http://webserver/test/jsp/buffer1.jsp http://webserver/test/jsp/buffer2.jsp http://webserver/test/jsp/buffer3.jsp http://webserver/test/jsp/buffer4.jsp http://webserver/test/jsp/comments.jsp http://webserver/test/jsp/extends1.jsp http://webserver/test/jsp/extends2.jsp http://webserver/test/jsp/pageAutoFlush.jsp http://webserver/test/jsp/pageDouble.jsp http://webserver/test/jsp/pageExtends.jsp http://webserver/test/jsp/pageImport2.jsp http://webserver/test/jsp/pageInfo.jsp http://webserver/test/jsp/pageInvalid.jsp http://webserver/test/jsp/pageIsErrorPage.jsp http://webserver/test/jsp/pageIsThreadSafe.jsp http://webserver/test/jsp/pageLanguage.jsp http://webserver/test/jsp/pageSession.jsp http://webserver/test/jsp/declaration/IntegerOverflow.jsp