UpHeron
All vulnerabilities

Servers and applications

CVE-2020-1938

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99,…

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 3 Mar 2022.

Severity
Critical 9.8
Published
24 Feb 2020
Last changed
25 Aug 2026
Added to UpHeron
21 Oct 2026
Fixed in
7.0.100, 8.5.51, 9.0.31
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • From 7.0.0 before 7.0.100
  • From 8.5.0 before 8.5.51
  • From 9.0.0 before 9.0.31

Known exploited

CISA name
Apache Tomcat Improper Privilege Management Vulnerability
Required action
Apply updates per vendor instructions.
Due for US agencies
17 Mar 2022
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-1938
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-1938