CVE-2018-1323

The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map…

published March 12, 2018

CVSS
—
EPSS
46%
Percentile
98.8
In the wild
Unconfirmed
What it is

The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via IIS, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing Tomcat via the reverse proxy.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.46397 · 98.8th percentile
Published
2018-03-12T16:00Z
EPSS history
Timeline
  • 22 SEP 03:16Z
    EPSS moved 46% → 67%
    epss
  • 06 SEP 03:11Z
    EPSS moved 46% → 67%
    epss
  • 30 AUG 16:01Z
    EPSS moved 67% → 46%
    epss
  • 29 AUG 04:37Z
    EPSS moved 46% → 67%
    epss
  • 12 MAR 16:00Z
    The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map…
    cvelistv5