CVE-2002-2007 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	29.78%	–	–
2022-04-03	–	–	29.78%	–	–
2023-03-12	–	–	–	0.31%	–
2023-03-26	–	–	–	0.25%	–
2023-06-04	–	–	–	0.3%	–
2023-09-03	–	–	–	0.3%	–
2023-11-05	–	–	–	0.26%	–
2024-02-11	–	–	–	2.47%	–
2024-03-17	–	–	–	3.08%	–
2024-06-02	–	–	–	3.7%	–
2024-06-02	–	–	–	3.7%	–
2024-08-11	–	–	–	3.35%	–
2024-08-25	–	–	–	3.35%	–
2024-09-22	–	–	–	0.25%	–
2024-12-22	–	–	–	0.35%	–
2025-01-19	–	–	–	0.35%	–
2025-03-18	–	–	–	–	22.34%
2025-03-30	–	–	–	–	22.61%
2025-05-01	–	–	–	–	22.61%
2025-05-04	–	–	–	–	22.61%
2025-05-04	–	–	–	–	22.61,%

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

Date	Percentile
2022-02-06	96%
2022-04-03	97%
2023-03-12	65%
2023-03-26	62%
2023-06-04	65%
2023-09-03	66%
2023-11-05	64%
2024-02-11	9%
2024-03-17	91%
2024-06-02	92%
2024-06-02	92%
2024-08-11	91%
2024-08-25	92%
2024-09-22	65%
2024-12-22	72%
2025-01-19	72%
2025-03-18	95%
2025-03-30	95%
2025-05-01	96%
2025-05-04	95%
2025-05-04	95%

source: https://www.securityfocus.com/bid/4878/info Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation. Under some circumstances, Tomcat may yield sensitive information about the web server configuration. When the realPath.jsp page is accessed, it may leak information. Upon being accessed, the realPath.jsp page will display the web root directory of the Tomcat implementation. http://example.com/test/realPath.jsp

source: https://www.securityfocus.com/bid/4876/info Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation. Under some circumstances, Tomcat may yield sensitive information about the web server configuration. When the source.jsp page is passed a malformed request, it may leak information. This information may include the web root directory, and possibly a directory listing. http://example.com:80/examples/jsp/source.jsp?? http://example.com:80/examples/jsp/source.jsp?/jsp/

source: https://www.securityfocus.com/bid/4877/info Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation. When Apache Tomcat is installed with a default configuration, several example files are also installed. When some of these example files are requested without any input, they will return an error containing the absolute path to the server's web root. The attacker can submit a request in one of the following formats: http://webserver/test/jsp/pageInfo.jsp http://webserver/test/jsp/pageImport2.jsp http://webserver/test/jsp/buffer1.jsp http://webserver/test/jsp/buffer2.jsp http://webserver/test/jsp/buffer3.jsp http://webserver/test/jsp/buffer4.jsp http://webserver/test/jsp/comments.jsp http://webserver/test/jsp/extends1.jsp http://webserver/test/jsp/extends2.jsp http://webserver/test/jsp/pageAutoFlush.jsp http://webserver/test/jsp/pageDouble.jsp http://webserver/test/jsp/pageExtends.jsp http://webserver/test/jsp/pageImport2.jsp http://webserver/test/jsp/pageInfo.jsp http://webserver/test/jsp/pageInvalid.jsp http://webserver/test/jsp/pageIsErrorPage.jsp http://webserver/test/jsp/pageIsThreadSafe.jsp http://webserver/test/jsp/pageLanguage.jsp http://webserver/test/jsp/pageSession.jsp http://webserver/test/jsp/declaration/IntegerOverflow.jsp