Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2020-1938

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

CVSS 9.8 · CriticalBuzz score 60.0KEV listed

Buzz score

Why this CVE is surfacing

Buzz score total 60.0

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 22.0 · diversity 13.0 · KEV 25.0 · OTX 0.0 · PoC 0.0
Mention score
22.0
8 evidence mentions in the snapshot
Diversity score
13.0
4 sources across 2 categories
KEV score
25.0
Known exploited vulnerability present
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
8 source links · newest first
  • Inside The UK’s Active Cyber Defense ProgramSecurityWeek

    UK’s National Cyber Security Centre highlights the success of its Active Cyber Defence (ACD) program

    newswww.securityweek.comMay 12, 2021, 3:45 PM
  • Top 10 most exploited vulnerabilities from 2020Help Net Security

    Vulnerability intelligence-as-a-service outfit vFeed has compiled a list of the top 10 most exploited vulnerabilities from 2020, and among them are SMBGhost, Zerologon, and SIGRed. What is vFeed? vFeed analyzes a variety of vendor advisories and third-party sources, correlates the gathered info, and compiles and constantly updates a vulnerability and threat intelligence database/feed that SOC and security teams can use to prioritize the remediation of security issues. In most cases, securing and protecting companies networks … More →

    newswww.helpnetsecurity.comFeb 3, 2021, 9:51 AM
  • Critical Vulnerability Patched in SAP CommerceSecurityWeek

    SAP this week released its June 2020 security patches, which address 19 vulnerabilities across the company’s product portfolio, including two rated critical .

    newswww.securityweek.comJun 10, 2020, 3:29 PM
  • Hackers Scanning for Apache Tomcat Servers Vulnerable to Ghostcat AttacksSecurityWeek

    Hackers have started scanning the web in search of Apache Tomcat servers affected by a recently disclosed vulnerability tracked as CVE-2020-1938 and dubbed Ghostcat .

    newswww.securityweek.comMar 5, 2020, 12:29 PM
  • Experts warn of mass scans for Apache Tomcat Ghostcat flawSecurity Affairs

    Experts warn of ongoing scans for Apache Tomcat servers affected by the Ghostcat flaw that could allow attackers to take over servers. Security experts are warning of ongoing scans for Apache Tomcat servers affected by the recently disclosed Ghostcat vulnerability CVE-2020-1938. The flaw affects all versions of Apache Tomcat, it could be exploited by attackers […]

    newssecurityaffairs.comMar 3, 2020, 7:58 AM
  • All versions of Apache Tomcat are affected by the Ghostcat flawSecurity Affairs

    Ghostcat flaw affects all versions of Apache Tomcat and could be exploited by hackers to read configuration files or install backdoors on vulnerable servers. All versions of Apache Tomcat are affected by a vulnerability dubbed Ghostcat that could be exploited by attackers to read configuration files or install backdoors on vulnerable servers. The vulnerability, tracked as […]

    newssecurityaffairs.comFeb 28, 2020, 10:45 PM
  • Apache Tomcat Affected by Serious ‘Ghostcat’ VulnerabilitySecurityWeek

    A serious vulnerability affecting Apache Tomcat can be exploited to read files from a server and in some cases even to achieve remote code execution.

    newswww.securityweek.comFeb 28, 2020, 7:31 PM
  • 24th February – Threat Intelligence BulletinCheck Point Research

    For the latest discoveries in cyber research for the week of 24th February 2020, please download our Threat Intelligence Bulletin. Top Attacks and Breaches Check Point researchers are following an evolving, ongoing Malspam campaign that is targeting more than 80 Turkish companies with the Adwind remote access Trojan. “The Turkish Rat” uses different evasive methods […]

    vendorresearch.checkpoint.comFeb 24, 2020, 1:33 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence