CVE-2000-0759: Jakarta Apache Tomcat Reveals Physical Paths

org.apache.tomcat:tomcat Updated 02 Oct 2025

Summary

30/04/2022

Disclosed on

CVE-2000-0759

CVE

No i

Fix available

Moderate

Severity

Not published

CVSS Score

CVE-2000-0759: Jakarta Apache Tomcat Reveals Physical Paths. Affects org.apache.tomcat:tomcat versions < 3.1. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Jakarta Apache Tomcat is a popular open-source web server and servlet container that provides a Java-based environment for running web applications. It is widely used for hosting Java web applications and is known for its robustness and scalability. However, in versions up to 3.1, Jakarta Tomcat under Apache has a vulnerability that allows remote attackers to reveal physical path information. When a URL that does not exist is requested, an error message is generated, which includes the physical path of the server.

Vulnerability Detail

The vulnerability in Jakarta Apache Tomcat allows an attacker to obtain sensitive information about the server's file system structure. By sending a specially crafted request for a non-existent URL, the attacker can trigger an error message that discloses the physical path of the server. This information can be used to gain a better understanding of the server's configuration and potentially exploit other vulnerabilities. The vulnerability has a moderate severity rating and was first published on April 30, 2022.

How To Fix

No fixed version is published for this vulnerability.

To fix this vulnerability, it is recommended to upgrade to a newer version of Jakarta Tomcat that includes a patch for this issue. The vulnerability was addressed in versions released after 3.1. Users should update their Tomcat installation to the latest stable release to ensure the security of their server.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

If upgrading to a newer version of Jakarta Tomcat is not immediately feasible, a temporary workaround is to modify the server's configuration to disable the display of detailed error messages. This can be achieved by setting the 'showErrorPage' attribute to 'false' in the server's configuration file. However, it is important to note that this workaround only hides the error messages and does not fix the underlying vulnerability.

Conclusion

In conclusion, the vulnerability in Jakarta Apache Tomcat that reveals physical paths can be mitigated by upgrading to a newer version of the software or applying a temporary workaround. It is important to prioritize the security of the server and promptly address this vulnerability to prevent potential exploitation. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.apache.tomcat:tomcat →