← Vulnerability feed

Vulnerability record · CVE-2003-1172 · published 31 December 2003

CVE-2003-1172: Apache cocoon vulnerability

Apache · Cocoon

Directory traversal vulnerability in the view-source sample file in Apache Software Foundation Cocoon 2.1 and 2.2 allows remote attackers to access arbitrary files via a .. (dot dot) in the filename parameter.

5.0 CVSS 2.0 Medium EPSS 31% · top 1.8%
5.0CVSS 2.0 base score
31%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
14References, 8 tagged exploit
16 Jun 2026Last modified by NVD

Description

Directory traversal vulnerability in the view-source sample file in Apache Software Foundation Cocoon 2.1 and 2.2 allows remote attackers to access arbitrary files via a .. (dot dot) in the filename parameter.

AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://issues.apache.org/bugzilla/show_bug.cgi?id=23949
http://secunia.com/advisories/10064 Exploit
http://securitytracker.com/id?1007993 Exploit
http://www.osvdb.org/2749
http://www.securiteam.com/securitynews/6W00L0U8KC.html ExploitPatch
http://www.securityfocus.com/bid/8883 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/13499
http://issues.apache.org/bugzilla/show_bug.cgi?id=23949
http://secunia.com/advisories/10064 Exploit
http://securitytracker.com/id?1007993 Exploit
http://www.osvdb.org/2749
http://www.securiteam.com/securitynews/6W00L0U8KC.html ExploitPatch
http://www.securityfocus.com/bid/8883 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/13499

Track CVE-2003-1172 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-49733Apache cocoon xml external entity (xxe) vulnerabilityImproper Restriction of XML External Entity Reference vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users…EPSS 1.3%9.8CVE-2022-45135Apache cocoon sql injection vulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Cocoon.This issue affects Apache Cocoon:…EPSS 1.1%7.5CVE-2025-24783Apache cocoon vulnerability** UNSUPPORTED WHEN ASSIGNED ** Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Apache Cocoon. This issue affects …EPSS 0.79%7.5CVE-2020-11991Apache Cocoon StreamGenerator XML external entity file disclosureApache Cocoon's StreamGenerator parses user-supplied XML without disabling external system entities, allowing XML External Entity (XXE) injection. An…EPSS 72%analysed

Source: NIST National Vulnerability Database (record CVE-2003-1172), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.