CVE-2014-8111 Missing authorization in n/a

Medium 5.0 Published 21 Apr 2015 Updated 6 Aug 2024

Remote attackers can bypass JkUnmount restrictions to access protected artifacts in Apache Tomcat Connectors due to improper rule handling.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2014-8111?

CVE-2014-8111 is a medium-severity missing authorization vulnerability in n/a, published on 21 Apr 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores JkUnmount rules for subtrees of previous JkMount rules, which allows remote attackers to access otherwise restricted artifacts via unspecified vectors.

Weakness: CWE-200

Which versions are affected by CVE-2014-8111?

It affects 1 product.

Products include Apache Tomcat Connectors.

How do I fix CVE-2014-8111?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2014-8111 being exploited?

There is no known exploitation of CVE-2014-8111 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2014-8111, DLA-240-1, DSA-3278-1, GHSA-f49p-9mwv-783f, MGASA-2015-0254.