Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates

Summary

Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.

Timeline

1. Jul 20, 2000Public exploit on Exploit-DB

   EDB-20131

2. Sep 21, 2000, 4:00 AM UTCCVE published
3. Aug 8, 2024, 5:28 AM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• org.apache.tomcat:tomcatMaven

  through 3.1

References 4