PT-2018-11712 · Apache · Apache Tomcat Jk Isapi Connector

Alphan Yavas · Publicado 2018-03-12 · Atualizado 2024-06-15 · CVE-2018-1323

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat JK ISAPI Connector versions 1.2.0 through 1.2.42

Description The issue concerns the normalization of requested paths in the Apache Tomcat JK ISAPI Connector. It did not handle certain edge cases correctly, potentially allowing a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing Tomcat via the reverse proxy.

Recommendations For Apache Tomcat JK ISAPI Connector versions 1.2.0 through 1.2.42, consider updating to a version that addresses this issue, as the current version may allow unintended exposure of application functionality. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Path traversal

Enumeração de Fraquezas

CWE-200

CWE-22

Identificadores relacionados

CVE-2018-1323

OPENSUSE-SU-2024:10625-1

Produtos afetados

Apache Tomcat Jk Isapi Connector

Referências · 15

• https://nvd.nist.gov/vuln/detail/CVE-2018-1323 · Nota de Segurança
• https://suse.com/security/cve/CVE-2018-11759 · Nota
• https://lists.apache.org/thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c%40%3Cdev.tomcat.apache.org%3E · Nota
• http://securityfocus.com/bid/103389 · Nota
• https://lists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomcat.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E · Nota
• https://lists.apache.org/thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925%40%3Cdev.tomcat.apache.org%3E · Nota
• https://access.redhat.com/errata/RHSA-2018:1843 · Aviso do Fabricante
• https://lists.apache.org/thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3E · Nota
• https://suse.com/security/cve/CVE-2018-1323 · Nota
• https://osv.dev/vulnerability/CVE-2018-1323 · Aviso do Fabricante
• https://lists.apache.org/thread.html/6e146bce83578bd870893250ba8354e28f9d8e86c674c30dbeee529f%40%3Cannounce.tomcat.apache.org%3E · Nota
• https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10625-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2007-0774 · Nota