CVE-2000-0672: The default configuration of Jakarta Tomcat does not restrict access to the /admin context, which allows re...

Security readout for executives and security teams

An old default setting in Jakarta Tomcat left its administrative interface open to anyone who could reach the server. An outside attacker could use that unrestricted admin area to read files from the server without needing a password. The issue applies to legacy Tomcat installs that were never hardened or upgraded. Exposure is limited today because affected Tomcat builds are more than two decades old. Risk remains only on unmaintained legacy systems, appliances, or forgotten internet-facing instances still running the vulnerable defaults with the /admin context reachable. Low priority for modern estates unless legacy Tomcat servers are still in production. If any are, prioritize inventory and retirement or upgrade because the flaw can expose sensitive files without credentials. Mitigation focus: Upgrade any legacy Tomcat instance to a currently supported release.; Remove or restrict the /admin context so it is not reachable from untrusted networks.; Require authentication and TLS on any remaining administrative interfaces..

Prepared

Jul 12, 2026, 00:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.