PT-2000-1691 · Apache · Jakarta Tomcat+1

Publicado 2000-10-20 · Atualizado 2022-04-30 · CVE-2000-0759

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jakarta Tomcat version 3.1

Description The issue allows a remote attacker to obtain physical path information when requesting a non-existent URL, resulting in an error message that includes the physical path. This occurs because requesting a non-existent JSP page generates an error page that includes the full file system path of the current context.

Recommendations For Jakarta Tomcat version 3.1, consider configuring the server to handle errors in a way that does not reveal sensitive path information, such as by creating a custom error page. As a temporary workaround, restrict access to non-existent URLs to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2000-0759

GHSA-QG4G-6JCQ-RW93

Produtos afetados

Apache Tomcat

Jakarta Tomcat

Referências · 8

• 🔥 http://securityfocus.com/bid/1531 · Exploit
• 🔥 https://exploit-db.com/exploits/20131 · Exploit
• https://osv.dev/vulnerability/GHSA-qg4g-6jcq-rw93 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2000-0759 · Nota de Segurança
• https://tomcat.apache.org/security-3 · Nota
• http://iss.net/security_center/static/4967.php · Nota
• http://securityfocus.com/frames/?content=/templates/archive.pike%3Flist%3D1%26date%3D2000-07-15%26msg%3DPine.SUN.3.96.1000719184401.17782A-100000%40grex.cyberspace.org · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0759 · Nota