{"answers":{"affected":"7 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-core and tomcat. It affects 21 products.","exploited":"Yes. Attackers have exploited CVE-2020-1938 in the wild since at least 3 Mar 2022.","fix":"Upgrade org.apache.tomcat.embed:tomcat-embed-core to a fixed version for your release line: 7.0.100, 8.5.51 or 9.0.31. US federal agencies must fix it by 17 Mar 2022.","what":"CVE-2020-1938 is a critical vulnerability in Apache Tomcat, published on 24 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2020-1938 and fix it if it is affected.\n\nWhat it is: CVE-2020-1938 is a critical vulnerability in Apache Tomcat, published on 24 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: Yes. Attackers have exploited CVE-2020-1938 in the wild since at least 3 Mar 2022.\n\nAffected packages and fixed versions:\n- org.apache.tomcat.embed:tomcat-embed-core (Maven): affected from 7.0.0; fixed in 7.0.100\n- org.apache.tomcat.embed:tomcat-embed-core (Maven): affected from 7.0.0; fixed in 7.0.100\n- org.apache.tomcat.embed:tomcat-embed-core (Maven): affected from 8.0.0; fixed in 8.5.51\n- org.apache.tomcat.embed:tomcat-embed-core (Maven): affected from 8.0.0; fixed in 8.5.51\n- org.apache.tomcat.embed:tomcat-embed-core (Maven): affected from 9.0.0; fixed in 9.0.31\n- org.apache.tomcat.embed:tomcat-embed-core (Maven): affected from 9.0.0; fixed in 9.0.31\n- tomcat (Bitnami): affected from 7.0.0; fixed in 7.0.100, 8.5.51, 9.0.31\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2020-1938/ (Markdown: https://insights.sbomify.com/CVE-2020-1938/index.md)","id":"CVE-2020-1938","markdown":"https://insights.sbomify.com/CVE-2020-1938/index.md","name":"CVE-2020-1938","record":{"aliases":["BIT-tomcat-2020-1938","DEBIAN-CVE-2020-1938","GHSA-c9hw-wf7x-jp9j","RHSA-2020:0855","RHSA-2020:0912","RHSA-2020:1478","RHSA-2020:2840","SUSE-SU-2020:0725-1","SUSE-SU-2020:0806-1","SUSE-SU-2020:14334-1","UBUNTU-CVE-2020-1938"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["code_execution","data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Apache Tomcat","requires_auth":"none","summary":"Attackers can read arbitrary files and execute code via AJP protocol if the connector is exposed, requiring an upgrade to hardened versions.","user_interaction":"not_required","vuln_class":"file_upload"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"apache","cpe":[{"product":"geode","vendor":"apache"},{"product":"tomcat","vendor":"apache"},{"product":"good_control","vendor":"blackberry"},{"product":"workspaces_server","vendor":"blackberry"},{"product":"debian_linux","vendor":"debian"},{"product":"fedora","vendor":"fedoraproject"},{"product":"data_availability_services","vendor":"netapp"},{"product":"oncommand_system_manager","vendor":"netapp"},{"product":"leap","vendor":"opensuse"},{"product":"agile_engineering_data_management","vendor":"oracle"},{"product":"agile_product_lifecycle_management","vendor":"oracle"},{"product":"communications_element_manager","vendor":"oracle"},{"product":"communications_instant_messaging_server","vendor":"oracle"},{"product":"health_sciences_empirica_inspections","vendor":"oracle"},{"product":"health_sciences_empirica_signal","vendor":"oracle"},{"product":"hospitality_guest_access","vendor":"oracle"},{"product":"instantis_enterprisetrack","vendor":"oracle"},{"product":"mysql_enterprise_monitor","vendor":"oracle"},{"product":"siebel_ui_framework","vendor":"oracle"},{"product":"transportation_management","vendor":"oracle"},{"product":"workload_manager","vendor":"oracle"}],"cvss":{"score":9.8,"severity":"critical","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.","ecosystems":["Bitnami","Maven","Red Hat:enterprise_linux:6::client","Red Hat:enterprise_linux:6::computenode","Red Hat:enterprise_linux:6::server","Red Hat:enterprise_linux:6::workstation","Red Hat:enterprise_linux:7::client","Red Hat:enterprise_linux:7::computenode","Red Hat:enterprise_linux:7::server","Red Hat:enterprise_linux:7::workstation","Red Hat:jboss_enterprise_application_platform:6::el5","Red Hat:jboss_enterprise_application_platform:6::el6","Red Hat:jboss_enterprise_application_platform:6::el7","Red Hat:rhel_eus:7.6::computenode","Red Hat:rhel_eus:7.6::server","SUSE:Enterprise Storage 5","SUSE:HPE Helion OpenStack 8","SUSE:Linux Enterprise Point of Sale 11 SP3","SUSE:Linux Enterprise Server 11 SP4-LTSS","SUSE:Linux Enterprise Server 12 SP1-LTSS","SUSE:Linux Enterprise Server 12 SP2-BCL","SUSE:Linux Enterprise Server 12 SP2-LTSS","SUSE:Linux Enterprise Server 12 SP3-BCL","SUSE:Linux Enterprise Server 12 SP3-LTSS","SUSE:Linux Enterprise Server for SAP Applications 12 SP1","SUSE:Linux Enterprise Server for SAP Applications 12 SP2","SUSE:Linux Enterprise Server for SAP Applications 12 SP3","SUSE:OpenStack Cloud 7","SUSE:OpenStack Cloud 8","SUSE:OpenStack Cloud Crowbar 8"],"exploits":{"exploitdb":2,"first_seen":"2020-02-20","github_poc":40,"max_poc_stars":422,"metasploit":1,"nuclei":1,"refs":[{"date":"2020-02-22T16:16:20Z","kind":"github_poc","ref":"https://github.com/00theway/Ghostcat-CNVD-2020-10487","stars":422,"title":"Ghostcat read file/code execute,CNVD-2020-10487(CVE-2020-1938) "},{"date":"2024-08-29T06:38:16Z","kind":"github_poc","ref":"https://github.com/lizhianyuguangming/TomcatScanPro","stars":296,"title":"tomcat自动化漏洞扫描利用工具，支持批量弱口令检测、后台部署war包getshell、CVE-2017-12615 文件上传、CVE-2020-1938/CNVD-2020-10487 文件包含"},{"date":"2020-02-20T21:00:15Z","kind":"github_poc","ref":"https://github.com/bkfish/CNVD-2020-10487-Tomcat-Ajp-lfi-Scanner","stars":294,"title":"Cnvd-2020-10487 / cve-2020-1938, scanner tool"},{"date":"2022-11-13T11:01:41Z","kind":"github_poc","ref":"https://github.com/tpt11fb/AttackTomcat","stars":258,"title":"Tomcat常见漏洞GUI利用工具。CVE-2017-12615 PUT文件上传漏洞、tomcat-pass-getshell 弱认证部署war包、弱口令爆破、CVE-2020-1938 Tomcat AJP文件读取/包含"},{"date":"2020-02-21T07:48:50Z","kind":"github_poc","ref":"https://github.com/sv3nbeast/CVE-2020-1938-Tomact-file_include-file_read","stars":57,"title":"Tomcat的文件包含及文件读取漏洞利用POC"},{"date":"2020-02-20T17:00:02Z","kind":"github_poc","ref":"https://github.com/xindongzhuaizhuai/CVE-2020-1938","stars":45,"title":null},{"date":"2020-02-21T02:36:37Z","kind":"github_poc","ref":"https://github.com/laolisafe/CVE-2020-1938","stars":38,"title":"CVE-2020-1938漏洞复现"},{"date":"2021-03-28T03:30:44Z","kind":"github_poc","ref":"https://github.com/Hancheng-Lei/Hacking-Vulnerability-CVE-2020-1938-Ghostcat","stars":24,"title":null}],"tier":"exploited"},"has_fix":true,"headline":"Apache Tomcat Improper Privilege Management","id":"CVE-2020-1938","indexable":true,"kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-17","knownRansomwareCampaignUse":"Unknown","product":"Tomcat","requiredAction":"Apply updates per vendor instructions.","vendorProject":"Apache","vulnerabilityName":"Apache Tomcat Improper Privilege Management Vulnerability"},"kind":"cve","links":{"ecosystem":"Bitnami","product":"apache:tomcat","products":["apache:tomcat","debian:debian_linux","fedoraproject:fedora","netapp:data_availability_services","opensuse:leap","oracle:agile_product_lifecycle_management","oracle:communications_element_manager","oracle:communications_instant_messaging_server","oracle:instantis_enterprisetrack","oracle:mysql_enterprise_monitor","oracle:siebel_ui_framework"],"type":"file_upload","year":"2020"},"n_packages":121,"n_references":51,"next":{"headline":"Null dereference in Apache NuttX (incubating)","id":"CVE-2020-1939"},"packages":[{"ecosystem":"Bitnami","fixed":["7.0.100","8.5.51","9.0.31"],"introduced":["7.0.0","8.5.0","9.0.0"],"last_affected":[],"package":"tomcat","purl":"pkg:bitnami/tomcat","source":"BIT-tomcat-2020-1938"},{"ecosystem":"Maven","fixed":["7.0.100"],"introduced":["7.0.0"],"last_affected":[],"package":"org.apache.tomcat.embed:tomcat-embed-core","purl":null,"source":"GHSA-c9hw-wf7x-jp9j"},{"ecosystem":"Maven","fixed":["7.0.100"],"introduced":["7.0.0"],"last_affected":[],"package":"org.apache.tomcat.embed:tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core","source":"GHSA-c9hw-wf7x-jp9j"},{"ecosystem":"Maven","fixed":["8.5.51"],"introduced":["8.0.0"],"last_affected":[],"package":"org.apache.tomcat.embed:tomcat-embed-core","purl":null,"source":"GHSA-c9hw-wf7x-jp9j"},{"ecosystem":"Maven","fixed":["8.5.51"],"introduced":["8.0.0"],"last_affected":[],"package":"org.apache.tomcat.embed:tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core","source":"GHSA-c9hw-wf7x-jp9j"},{"ecosystem":"Maven","fixed":["9.0.31"],"introduced":["9.0.0"],"last_affected":[],"package":"org.apache.tomcat.embed:tomcat-embed-core","purl":null,"source":"GHSA-c9hw-wf7x-jp9j"},{"ecosystem":"Maven","fixed":["9.0.31"],"introduced":["9.0.0"],"last_affected":[],"package":"org.apache.tomcat.embed:tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core","source":"GHSA-c9hw-wf7x-jp9j"},{"ecosystem":"Red Hat:enterprise_linux:6::client","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6","purl":"pkg:rpm/redhat/tomcat6","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::client","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-admin-webapps","purl":"pkg:rpm/redhat/tomcat6-admin-webapps","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::client","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-docs-webapp","purl":"pkg:rpm/redhat/tomcat6-docs-webapp","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::client","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-el-2.1-api","purl":"pkg:rpm/redhat/tomcat6-el-2.1-api","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::client","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-javadoc","purl":"pkg:rpm/redhat/tomcat6-javadoc","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::client","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-jsp-2.1-api","purl":"pkg:rpm/redhat/tomcat6-jsp-2.1-api","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::client","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-lib","purl":"pkg:rpm/redhat/tomcat6-lib","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::client","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-servlet-2.5-api","purl":"pkg:rpm/redhat/tomcat6-servlet-2.5-api","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::client","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-webapps","purl":"pkg:rpm/redhat/tomcat6-webapps","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6","purl":"pkg:rpm/redhat/tomcat6","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-admin-webapps","purl":"pkg:rpm/redhat/tomcat6-admin-webapps","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-docs-webapp","purl":"pkg:rpm/redhat/tomcat6-docs-webapp","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-el-2.1-api","purl":"pkg:rpm/redhat/tomcat6-el-2.1-api","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-javadoc","purl":"pkg:rpm/redhat/tomcat6-javadoc","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-jsp-2.1-api","purl":"pkg:rpm/redhat/tomcat6-jsp-2.1-api","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-lib","purl":"pkg:rpm/redhat/tomcat6-lib","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-servlet-2.5-api","purl":"pkg:rpm/redhat/tomcat6-servlet-2.5-api","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-webapps","purl":"pkg:rpm/redhat/tomcat6-webapps","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::server","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6","purl":"pkg:rpm/redhat/tomcat6","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::server","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-admin-webapps","purl":"pkg:rpm/redhat/tomcat6-admin-webapps","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::server","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-docs-webapp","purl":"pkg:rpm/redhat/tomcat6-docs-webapp","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::server","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-el-2.1-api","purl":"pkg:rpm/redhat/tomcat6-el-2.1-api","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::server","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-javadoc","purl":"pkg:rpm/redhat/tomcat6-javadoc","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::server","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-jsp-2.1-api","purl":"pkg:rpm/redhat/tomcat6-jsp-2.1-api","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::server","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-lib","purl":"pkg:rpm/redhat/tomcat6-lib","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::server","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-servlet-2.5-api","purl":"pkg:rpm/redhat/tomcat6-servlet-2.5-api","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::server","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-webapps","purl":"pkg:rpm/redhat/tomcat6-webapps","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6","purl":"pkg:rpm/redhat/tomcat6","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-admin-webapps","purl":"pkg:rpm/redhat/tomcat6-admin-webapps","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-docs-webapp","purl":"pkg:rpm/redhat/tomcat6-docs-webapp","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-el-2.1-api","purl":"pkg:rpm/redhat/tomcat6-el-2.1-api","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-javadoc","purl":"pkg:rpm/redhat/tomcat6-javadoc","source":"RHSA-2020:0912"},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","fixed":["0:6.0.24-114.el6_10"],"introduced":["0"],"last_affected":[],"package":"tomcat6-jsp-2.1-api","purl":"pkg:rpm/redhat/tomcat6-jsp-2.1-api","source":"RHSA-2020:0912"}],"prev":{"headline":"SQL Injection in Kylin","id":"CVE-2020-1937"},"products":["Apache Tomcat"],"published":"2020-02-24","related":[{"cvss_score":7.8,"headline":"Docker Desktop Community Edition Privilege Escalation","id":"CVE-2019-15752","kev_date_added":"2021-11-03","published":"2019-08-28"},{"cvss_score":9.8,"headline":"Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8.","id":"CVE-2022-37021","kev_date_added":null,"published":"2022-08-31"},{"cvss_score":9.8,"headline":"Supply chain in docker.io","id":"CVE-2014-0048","kev_date_added":null,"published":"2020-01-02"},{"cvss_score":9.8,"headline":"Apache Geode unsafe deserialization in TcpServer","id":"CVE-2017-15692","kev_date_added":null,"published":"2018-02-27"},{"cvss_score":8.8,"headline":"Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system","id":"CVE-2025-47410","kev_date_added":null,"published":"2025-10-18"},{"cvss_score":8.8,"headline":"Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 11","id":"CVE-2022-37022","kev_date_added":null,"published":"2022-08-31"}],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"open","licence":"CC0 1.0","name":"CISA KEV"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"yes","exploitation":"active","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-10-21","vendors":["Apache"]},"summary":"Attackers can read arbitrary files and execute code via AJP protocol if the connector is exposed, requiring an upgrade to hardened versions.","url":"https://insights.sbomify.com/CVE-2020-1938/"}