Critical · published February 25, 2020
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.
🚨 A single AJP connection is all it takes to turn your Tomcat server into a playground for attackers! 🔥 Think of it as a trusted delivery service that, instead of verifying packages, drops them off at the front door without checking — a sneaky way for an unwanted visitor to mix in with your deliveries! 📦 An attacker could exploit this vulnerability to read arbitrary files, execute malicious JSP code, and gain control over your server. It's like leaving the front door wide open and inviting a burglar in to have a party — any sensitive data or functionality could be at risk!
Think of it as a trusted delivery service that, instead of verifying packages, drops them off at the front door without checking — a sneaky way for an unwanted visitor to mix in with your deliveries! 📦 This vulnerability arises from the AJP protocol in Apache Tomcat, which incorrectly trusts incoming connections, allowing attackers to return arbitrary files and potentially execute remote code if they can upload files within the web application.
An attacker could exploit this vulnerability to read arbitrary files, execute malicious JSP code, and gain control over your server. It's like leaving the front door wide open and inviting a burglar in to have a party — any sensitive data or functionality could be at risk! To secure your server, upgrade to Apache Tomcat versions 9.0.31, 8.5.51, or 7.0.100 or later. If AJP is not needed, consider disabling it altogether to avoid any risk. A thorough audit of your configuration settings is also recommended! You’ve got this! By upgrading and tightening those settings, you’ll make your server a fortress! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| apache/geode | all versions | — |
| apache/tomcat | ≥ 7.0.0, < 7.0.100 | 7.0.100 |
| apache/tomcat | ≥ 8.5.0, < 8.5.51 | 8.5.51 |
| apache/tomcat | ≥ 9.0.0, < 9.0.31 | 9.0.31 |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| oracle/agile_engineering_data_management | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/communications_element_manager | all versions | — |
| oracle/communications_element_manager | all versions | — |
| oracle/communications_element_manager | all versions | — |
| oracle/communications_instant_messaging_server | all versions | — |
| oracle/health_sciences_empirica_inspections | all versions | — |
| oracle/health_sciences_empirica_signal | all versions | — |
| oracle/hospitality_guest_access | all versions | — |
| oracle/hospitality_guest_access | all versions | — |
| oracle/instantis_enterprisetrack | ≥ 17.1, ≤ 17.3 | — |
| oracle/mysql_enterprise_monitor | ≤ 4.0.12 | — |
| oracle/mysql_enterprise_monitor | ≥ 8.0.0, ≤ 8.0.20 | — |
| oracle/siebel_ui_framework | ≤ 20.5 | — |
| oracle/transportation_management | all versions | — |
| oracle/workload_manager | all versions | — |
| oracle/workload_manager | all versions | — |
| oracle/workload_manager | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| opensuse/leap | all versions | — |
| blackberry/good_control | ≤ 5.2.58.38 | — |
| blackberry/workspaces_server | all versions | — |
| blackberry/workspaces_server | all versions | — |
| blackberry/workspaces_server | all versions | — |
| blackberry/workspaces_server | all versions | — |
| netapp/data_availability_services | all versions | — |
| netapp/oncommand_system_manager | ≥ 3.0.0, ≤ 3.1.3 | — |