PT-2020-1704 · Apache+5 · Apache Tomcat+5
Published
2020-02-11
·
Updated
2026-05-18
·
CVE-2020-1938
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Apache Tomcat versions 7.0.0 through 7.0.99
Apache Tomcat versions 8.5.0 through 8.5.50
Apache Tomcat versions 9.0.0.M1 through 9.0.0.30
Description
The issue is related to the Apache JServ Protocol (AJP) connector in Apache Tomcat, which can allow an attacker to read arbitrary files from anywhere in the web application, including under the WEB-INF and META-INF directories, as well as process any file in the web application as a JSP, potentially leading to remote code execution. This can occur if the AJP port is accessible to untrusted users. The vulnerability can be exploited by sending a request to the AJP port, allowing the attacker to read and execute files on the server.
Recommendations
To resolve the issue, upgrade to Apache Tomcat 7.0.100 or later.
To resolve the issue, upgrade to Apache Tomcat 8.5.51 or later.
To resolve the issue, upgrade to Apache Tomcat 9.0.31 or later.
As a temporary workaround, consider disabling the AJP Connector to prevent exploitation until a patch is available.
Exploit
Fix
Information Disclosure
Improper Authorization
Improper Privilege Management
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Apache Tomcat
Centos
Red Hat
Rocky Linux
Suse