CVE-2002-2009: Undefined Security Weakness

Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by 1 +/, 2 /, 3 , and 4 %20/, which leaks the pathname in an error message...

CVE-2002-2008: Undefined Security Weakness

Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message...