PT-2000-1691 · Apache · Jakarta Tomcat+1

Published 2000-10-20 · Updated 2022-04-30 · CVE-2000-0759

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jakarta Tomcat version 3.1

Description The issue allows a remote attacker to obtain physical path information when requesting a non-existent URL, resulting in an error message that includes the physical path. This occurs because requesting a non-existent JSP page generates an error page that includes the full file system path of the current context.

Recommendations For Jakarta Tomcat version 3.1, consider configuring the server to handle errors in a way that does not reveal sensitive path information, such as by creating a custom error page. As a temporary workaround, restrict access to non-existent URLs to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2000-0759

GHSA-QG4G-6JCQ-RW93

Affected Products

Apache Tomcat

Jakarta Tomcat

References · 8

• 🔥 http://securityfocus.com/bid/1531 · Exploit
• 🔥 https://exploit-db.com/exploits/20131 · Exploit
• https://osv.dev/vulnerability/GHSA-qg4g-6jcq-rw93 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2000-0759 · Security Note
• https://tomcat.apache.org/security-3 · Note
• http://iss.net/security_center/static/4967.php · Note
• http://securityfocus.com/frames/?content=/templates/archive.pike%3Flist%3D1%26date%3D2000-07-15%26msg%3DPine.SUN.3.96.1000719184401.17782A-100000%40grex.cyberspace.org · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0759 · Note