Information disclosure in Apache Tomcat Connectors
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 1 fixed, 3 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-200.
Summary
The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via IIS, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing Tomcat via the reverse proxy.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
Red Hat 1 advisory
- RHSA-2018:1843 Released 2018-06-13 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.23 security update
- Red Hat JBoss Core Services
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Core Services | Affected | No fix yet |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix yet |
| Red Hat JBoss Enterprise Web Server 2 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Core Services | Fixed | RHSA-2018:1843 |
Timeline
- 2026-10-02 Threatist record created from CVE-2018-1323
- 2026-10-03 Alias added: GHSA-jxj8-3w7h-p8mx
References
Advisory 1
Other 7
- https://lists.apache.org/thread.html/6e146bce83578bd870893250ba8354e28f9d8e86c674c30dbeee529f%40%3Cannounce.tomcat.apache.org%3E
- [tomcat-dev] 20190319 svn commit: r1855831 [26/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190325 svn commit: r1856174 [25/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20190413 svn commit: r1857494 [18/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190415 svn commit: r1857582 [20/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
- [tomcat-dev] 20200203 svn commit: r1873527 [26/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [30/34] - /tomcat/site/trunk/docs/
More Apache Tomcat Jk Connector vulnerabilities
- TI-2018-08416 Path traversal in Apache Tomcat Connectors CVSS 3.0HIGH 7.5
- TI-2016-05849 Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42. CVSS 3.0CRITICAL 9.8
Sources
- CVE-2018-1323 · CVE Program
- CVE-2018-1323 · NVD
- FIRST EPSS
- GHSA-jxj8-3w7h-p8mx · GitHub Advisory Database · CC BY 4.0
- CVE-2018-1323 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences