The vulnerability explicitly involves two example servlets (SnoopServlet and TroubleShooter) that were included in default installations. These servlets' request handling methods would appear in runtime profiles when exploited, as they directly process attacker requests to disclose sensitive information. The Tomcat security page confirms these were mitigation targets in version 4.0.2/4.1.0+ by removal/disablement. Though no code diffs are provided, the CVE description and Tomcat's own security notes explicitly identify these components as the vulnerability source.