CVEs / CVE-2020-1938

CVE-2020-1938: Apache Tomcat Improper Privilege Management Vulnerability

Known exploited in the CISA KEV catalog since 3 Mar 2022
critical 9.8 CVSS 3.1 (NVD)
EPSS 99.2% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
Last changed at its sources 24 Oct 2026

Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.

Check your servers with Stackurity Already using Stackurity? Search for CVE-2020-1938

Summary

Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.
CISA, Known Exploited Vulnerabilities catalog

Description

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
The CVE record, via NVD · published 24 Feb 2020 · NVD status: Analyzed

Affected and fixed versions

As stated by the CVE record (from the CNA)
Product	Affected	Fixed in
Apache Apache Tomcat	Apache Tomcat 9.0.0.M1 to 9.0.0.30	—
Apache Apache Tomcat	8.5.0 to 8.5.50	—
Apache Apache Tomcat	7.0.0 to 7.0.99	—

As stated by OSV
Product	Affected	Fixed in
org.apache.tomcat.embed:tomcat-embed-core (Maven)	from 9.0.0, before 9.0.31	9.0.31
org.apache.tomcat.embed:tomcat-embed-core (Maven)	from 8.0.0, before 8.5.51	8.5.51
org.apache.tomcat.embed:tomcat-embed-core (Maven)	from 7.0.0, before 7.0.100	7.0.100

Package versions from GHSA-c9hw-wf7x-jp9j.

Exploitation

In CISA KEV since	3 Mar 2022
Due date for US federal agencies	17 Mar 2022
Used in ransomware campaigns	Unknown
Required action	Apply updates per vendor instructions.

Severity

CVSS 3.1	9.8 critical `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` Scored by NVD

References

Sources

Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.

This product uses data from the NVD API but is not endorsed or certified by the NVD.