CVE-2020-1938

Aliases:GHSA-c9hw-wf7x-jp9jBIT-tomcat-2020-1938
Advisory lineage Upstream: 0 Downstream: 31
Analyzed
Published: 24 Feb 2020, 21:19
Last modified:21 Oct 2025, 23:35

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (cve.org)
EPSS Score
94.47% CRITICAL
94% probability 0.00%
KEV
Listed
CISA
1 listing
Ransomware
No reports
Public exploits
4 found
Dark Web
Not detected

Timeline

24 Feb 2020, 21:19
Published
Vulnerability first disclosed
03 Mar 2022, 00:00
Added to CISA KEV
Apache Tomcat Improper Privilege Management Vulnerability
17 Mar 2022, 00:00
CISA Remediation Due
Apply updates per vendor instructions.
21 Oct 2025, 23:35
Last Modified
Vulnerability information updated

Description

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
  • v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 94.47%• Percentile: 100%

Affected Systems

  • apache•apache tomcat

    Apache Tomcat 9.0.0.M1 to 9.0.0.30 | 8.5.0 to 8.5.50 | 7.0.0 to 7.0.99

  • apache•geode

    1.12.0

  • Unknown•Tomcat

    ≥ 7.0.0, < 7.0.100 | ≥ 8.5.0, < 8.5.51 | ≥ 9.0.0, < 9.0.31

  • blackberry•good_control

    ≤ 5.2.58.38

  • blackberry•workspaces server

    7.0.1 | 7.1.2 | 8.1.0 | 9.0

  • debian•debian_linux

    8.0 | 9.0 | 10.0

  • fedoraproject•fedora

    30 | 31 | 32

  • org.apache.tomcat.embed•tomcat-embed-core

    ≥ 9.0.0, < 9.0.31 | ≥ 8.0.0, < 8.5.51 | ≥ 7.0.0, < 7.0.100

  • netapp•data_availability_services

    na

  • netapp•oncommand_system_manager

    ≥ 3.0.0, ≤ 3.1.3

  • opensuse•leap

    15.1

  • oracle•agile_engineering_data_management

    6.2.1.0

  • oracle•agile_plm

    9.3.3 | 9.3.5 | 9.3.6

  • oracle•communications_element_manager

    8.1.1 | 8.2.0 | 8.2.1

  • oracle•communications_instant_messaging_server

    10.0.1.4.0

  • oracle•health_sciences_empirica_inspections

    1.0.1.2

  • oracle•health_sciences_empirica_signal

    7.3.3

  • oracle•hospitality_guest_access

    4.2.0 | 4.2.1

  • oracle•instantis_enterprisetrack

    ≥ 17.1, ≤ 17.3

  • oracle•mysql_enterprise_monitor

    ≤ 4.0.12 | ≥ 8.0.0, ≤ 8.0.20

  • oracle•siebel_ui_framework

    ≤ 20.5

  • oracle•transportation_management

    6.3.7

  • oracle•workload_manager

    12.2.0.1 | 18c | 19c

References (96)