CVE-2000-0759
Jakarta Apache Tomcat Reveals Physical Paths
CVE-2000-0759 is a medium vulnerability (CVSS 6.4) in Apache Tomcat, published September 21, 2000. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 25.7%, the 97th percentile. No source names a fixed version.
Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.
Exploit likelihood
What each source reports
NVD Score used
Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.
- Record
CVE-2000-0759- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.
- Record
CVE-2000-0759- Updated
- 2026-11-02
EUVDEUVD-2022-1815 No score
Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.
- Record
EUVD-2022-1815- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qg4g-6jcq-rw93 No score
Jakarta Apache Tomcat Reveals Physical Paths
Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.
- Record
GHSA-qg4g-6jcq-rw93- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-qg4g-6jcq-rw93 No score
Jakarta Apache Tomcat Reveals Physical Paths
Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.
- Record
GHSA-qg4g-6jcq-rw93- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
through 3.1 | None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Tomcat 3.1 - Path Revealing | 2000-07-20 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
References
securityfocus.com/bid/1531
iss.net/security_center/static/4967.php
nvd.nist.gov/vuln/detail/CVE-2000-0759
github.com/advisories/GHSA-qg4g-6jcq-rw93