PT-2018-11712 · Apache · Apache Tomcat Jk Isapi Connector

Alphan Yavas · Published 2018-03-12 · Updated 2024-06-15 · CVE-2018-1323

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat JK ISAPI Connector versions 1.2.0 through 1.2.42

Description The issue concerns the normalization of requested paths in the Apache Tomcat JK ISAPI Connector. It did not handle certain edge cases correctly, potentially allowing a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing Tomcat via the reverse proxy.

Recommendations For Apache Tomcat JK ISAPI Connector versions 1.2.0 through 1.2.42, consider updating to a version that addresses this issue, as the current version may allow unintended exposure of application functionality. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Path traversal

Weakness Enumeration

CWE-200

CWE-22

Related Identifiers

CVE-2018-1323

OPENSUSE-SU-2024:10625-1

Affected Products

Apache Tomcat Jk Isapi Connector

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2018-1323 · Security Note
• https://access.redhat.com/errata/RHSA-2018:1843 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1323 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10625-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2018-11759 · Note
• https://lists.apache.org/thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c%40%3Cdev.tomcat.apache.org%3E · Note
• http://securityfocus.com/bid/103389 · Note
• https://lists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomcat.apache.org%3E · Note
• https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E · Note
• https://lists.apache.org/thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925%40%3Cdev.tomcat.apache.org%3E · Note
• https://lists.apache.org/thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3E · Note
• https://suse.com/security/cve/CVE-2018-1323 · Note
• https://lists.apache.org/thread.html/6e146bce83578bd870893250ba8354e28f9d8e86c674c30dbeee529f%40%3Cannounce.tomcat.apache.org%3E · Note
• https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E · Note
• https://suse.com/security/cve/CVE-2007-0774 · Note