Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.4

Apache Tomcat 3.x discloses system details via .snp request

CVE-2000-0760 · published 26 years ago
Summary

Tomcat versions 3.0 and 3.1 expose internal system information when someone asks for a missing file that ends with .snp. This can help an outsider learn details about the server that should stay private. Disable the Snoop servlet or upgrade to a version where it is removed to stop the disclosure.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
apache tomcat 3.0
3.1
cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:*
Original advisory text
The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.
The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.4 Medium
Exploitation
62% chance of attack within 30 days
Timeline
Published20 Oct 2000
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2000-0760 · NVD
Track software like this
Free during beta