CVE-2007-1860 mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protect...
MediumCVSS 5.0
EPSS 13.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache tomcat jk web server connector | <= 1.2.22 | No fix listed |
| debian/libapache-mod-jk(Debian:12) | < 1:1.2.23-1 | 1:1.2.23-1 |
| debian/libapache-mod-jk(Debian:13) | < 1:1.2.23-1 | 1:1.2.23-1 |
| debian/libapache-mod-jk(Debian:14) | < 1:1.2.23-1 | 1:1.2.23-1 |
References
- docs.info.apple.com
- SSRT071447 vendor-advisory
- APPLE-SA-2007-07-31 vendor-advisory
- SUSE-SR:2008:005 vendor-advisory
- 25383 patch third-party-advisory vendor-advisory
- 25701 third-party-advisory vendor-advisory
- 26235 third-party-advisory vendor-advisory
- 26512 third-party-advisory vendor-advisory
- 27037 third-party-advisory vendor-advisory
- 29242 third-party-advisory vendor-advisory
- GLSA-200708-15 vendor-advisory
- tomcat.apache.org patch
- tomcat.apache.org patch
- DSA-1312 vendor-advisory
- 34877 vdb-entry
- RHSA-2007:0379 vendor-advisory
- RHSA-2008:0261 vendor-advisory
- 24147 vdb-entry
- 25159 vdb-entry
- 1018138 vdb-entry
- ADV-2007-1941 vdb-entry vendor-advisory
- ADV-2007-2732 vdb-entry vendor-advisory
- ADV-2007-3386 vdb-entry vendor-advisory
- tomcat-jkconnector-security-bypass(34496) vdb-entry
- [tomcat-dev] 20190413 svn commit: r1857494 [18/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [20/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [25/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190319 svn commit: r1855831 [26/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [30/34] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [26/30] - /tomcat/site/trunk/docs/ mailing-list
- oval:org.mitre.oval:def:6002 signature vdb-entry
- Debian Security Tracker CVE-2007-1860 vendor-advisory
- bugs.debian.org issue-tracking