CVE-2020-1938 Apache Tomcat Improper Privilege Management

What is CVE-2020-1938?

CVE-2020-1938 is a critical vulnerability in Apache Tomcat, published on 24 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

Which versions are affected by CVE-2020-1938?

7 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-core and tomcat. It affects 21 products.

Products include Apache Geode, Apache Tomcat, Blackberry Good Control, Blackberry Workspaces Server, Debian Debian Linux, Fedoraproject Fedora and 15 more.

How do I fix CVE-2020-1938?

Upgrade org.apache.tomcat.embed:tomcat-embed-core to a fixed version for your release line: 7.0.100, 8.5.51 or 9.0.31. US federal agencies must fix it by 17 Mar 2022.

Is CVE-2020-1938 being exploited?

Yes. Attackers have exploited CVE-2020-1938 in the wild since at least 3 Mar 2022.

Public exploit code: 1 Metasploit module, 2 Exploit-DB entries, 1 Nuclei template and 40 proofs of concept on GitHub.

Other vulnerabilities in Apache Tomcat

• CVE-2019-15752 Docker Desktop Community Edition Privilege Escalation Exploited High 7.8
• CVE-2022-37021 Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8. Critical 9.8
• CVE-2014-0048 Supply chain in docker.io Critical 9.8
• CVE-2017-15692 Apache Geode unsafe deserialization in TcpServer Critical 9.8
• CVE-2025-47410 Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system High 8.8

All Apache Tomcat vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-tomcat-2020-1938, DEBIAN-CVE-2020-1938, GHSA-c9hw-wf7x-jp9j, RHSA-2020:0855, RHSA-2020:0912, RHSA-2020:1478 and 5 more.