CVE-2000-0760 in Tomcat
Summary
by MITRE
The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/12/2025
The vulnerability identified as CVE-2000-0760 represents a critical information disclosure flaw within the Apache Jakarta Tomcat web server versions 3.0 and 3.1. This vulnerability specifically affects the Snoop servlet component which is designed for diagnostic purposes but becomes exploitable when handling malformed requests. The flaw manifests when attackers submit requests for non-existent URLs that end with the .snp file extension, triggering the servlet to reveal sensitive system information to remote attackers. This represents a classic case of improper input validation and inadequate access controls within server-side components.
The technical implementation of this vulnerability stems from the Snoop servlet's lack of proper authentication and authorization checks when processing requests. When a request is made with a .snp extension, the servlet bypasses normal access controls and directly exposes internal system details including file system paths, operating system information, and potentially other sensitive configuration data. This behavior aligns with CWE-200, which categorizes weaknesses related to improper information exposure, and demonstrates how diagnostic tools can become security risks when deployed in production environments without proper restrictions. The vulnerability operates at the application layer and can be exploited through standard HTTP requests without requiring any special privileges or authentication credentials.
From an operational impact perspective, this vulnerability poses significant risks to organizations running affected Tomcat versions as it allows attackers to gather intelligence for further exploitation attempts. The disclosed information can include detailed system configurations, directory structures, and potentially sensitive file paths that could be leveraged in subsequent attacks. Attackers might use this information to plan more sophisticated attacks such as directory traversal exploits or to identify other potential vulnerabilities within the system. The vulnerability also violates fundamental security principles of least privilege and defense in depth, as it provides unauthorized access to system information that should remain confidential.
Organizations affected by this vulnerability should immediately implement mitigations including upgrading to patched versions of Jakarta Tomcat, disabling the Snoop servlet in production environments, and implementing proper access controls for diagnostic components. Network-level protections such as firewalls and intrusion detection systems can help detect and block requests containing .snp extensions. The ATT&CK framework categorizes this as an information gathering technique under the reconnaissance phase, where adversaries collect system information to inform their attack strategies. Additionally, implementing proper input validation and sanitization measures across all web applications can prevent similar vulnerabilities from manifesting in other components of the system architecture.