# CVE-2020-1938: Apache Tomcat Improper Privilege Management

> Attackers can read arbitrary files and execute code via AJP protocol if the connector is exposed, requiring an upgrade to hardened versions.

- **Severity:** Critical 9.8 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Yes, since 3 Mar 2022 (CISA KEV)
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 24 Feb 2020
- **Updated:** 21 Oct 2025
- **Also known as:** BIT-tomcat-2020-1938, DEBIAN-CVE-2020-1938, GHSA-c9hw-wf7x-jp9j, RHSA-2020:0855, RHSA-2020:0912, RHSA-2020:1478, RHSA-2020:2840, SUSE-SU-2020:0725-1, SUSE-SU-2020:0806-1, SUSE-SU-2020:14334-1, UBUNTU-CVE-2020-1938

## What is CVE-2020-1938?

CVE-2020-1938 is a critical vulnerability in Apache Tomcat, published on 24 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

## Which versions are affected by CVE-2020-1938?

7 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-core and tomcat. It affects 21 products.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `org.apache.tomcat.embed:tomcat-embed-core` | Maven | From 7.0.0 | 7.0.100 |
| `org.apache.tomcat.embed:tomcat-embed-core` | Maven | From 7.0.0 | 7.0.100 |
| `org.apache.tomcat.embed:tomcat-embed-core` | Maven | From 8.0.0 | 8.5.51 |
| `org.apache.tomcat.embed:tomcat-embed-core` | Maven | From 8.0.0 | 8.5.51 |
| `org.apache.tomcat.embed:tomcat-embed-core` | Maven | From 9.0.0 | 9.0.31 |
| `org.apache.tomcat.embed:tomcat-embed-core` | Maven | From 9.0.0 | 9.0.31 |
| `tomcat` | Bitnami | From 7.0.0 | 7.0.100, 8.5.51, 9.0.31 |
| `tomcat6` | Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-admin-webapps` | Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-docs-webapp` | Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-el-2.1-api` | Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-javadoc` | Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-jsp-2.1-api` | Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-lib` | Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-servlet-2.5-api` | Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-webapps` | Red Hat:enterprise_linux:6::client | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6` | Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-admin-webapps` | Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-docs-webapp` | Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-el-2.1-api` | Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-javadoc` | Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-jsp-2.1-api` | Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-lib` | Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-servlet-2.5-api` | Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-webapps` | Red Hat:enterprise_linux:6::computenode | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6` | Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-admin-webapps` | Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-docs-webapp` | Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-el-2.1-api` | Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-javadoc` | Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-jsp-2.1-api` | Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-lib` | Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-servlet-2.5-api` | Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-webapps` | Red Hat:enterprise_linux:6::server | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6` | Red Hat:enterprise_linux:6::workstation | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-admin-webapps` | Red Hat:enterprise_linux:6::workstation | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-docs-webapp` | Red Hat:enterprise_linux:6::workstation | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-el-2.1-api` | Red Hat:enterprise_linux:6::workstation | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-javadoc` | Red Hat:enterprise_linux:6::workstation | All versions | 0:6.0.24-114.el6_10 |
| `tomcat6-jsp-2.1-api` | Red Hat:enterprise_linux:6::workstation | All versions | 0:6.0.24-114.el6_10 |

Products: Apache Geode, Apache Tomcat, Blackberry Good Control, Blackberry Workspaces Server, Debian Debian Linux, Fedoraproject Fedora, Netapp Data Availability Services, Netapp Oncommand System Manager, Opensuse Leap, Oracle Agile Engineering Data Management, Oracle Agile Product Lifecycle Management, Oracle Communications Element Manager, Oracle Communications Instant Messaging Server, Oracle Health Sciences Empirica Inspections, Oracle Health Sciences Empirica Signal, Oracle Hospitality Guest Access, Oracle Instantis Enterprisetrack, Oracle Mysql Enterprise Monitor, Oracle Siebel Ui Framework, Oracle Transportation Management and 1 more.

## How do I fix CVE-2020-1938?

Upgrade org.apache.tomcat.embed:tomcat-embed-core to a fixed version for your release line: 7.0.100, 8.5.51 or 9.0.31. US federal agencies must fix it by 17 Mar 2022.

## Is CVE-2020-1938 being exploited?

Yes. Attackers have exploited CVE-2020-1938 in the wild since at least 3 Mar 2022.

Public exploit code:

- Ghostcat read file/code execute,CNVD-2020-10487(CVE-2020-1938)  (github_poc): https://github.com/00theway/Ghostcat-CNVD-2020-10487
- tomcat自动化漏洞扫描利用工具，支持批量弱口令检测、后台部署war包getshell、CVE-2017-12615 文件上传、CVE-2020-1938/CNVD-2020-10487 文件包含 (github_poc): https://github.com/lizhianyuguangming/TomcatScanPro
- Cnvd-2020-10487 / cve-2020-1938, scanner tool (github_poc): https://github.com/bkfish/CNVD-2020-10487-Tomcat-Ajp-lfi-Scanner
- Tomcat常见漏洞GUI利用工具。CVE-2017-12615 PUT文件上传漏洞、tomcat-pass-getshell 弱认证部署war包、弱口令爆破、CVE-2020-1938 Tomcat AJP文件读取/包含 (github_poc): https://github.com/tpt11fb/AttackTomcat
- Tomcat的文件包含及文件读取漏洞利用POC (github_poc): https://github.com/sv3nbeast/CVE-2020-1938-Tomact-file_include-file_read
- https://github.com/xindongzhuaizhuai/CVE-2020-1938 (github_poc): https://github.com/xindongzhuaizhuai/CVE-2020-1938

## Other vulnerabilities in Apache Tomcat

- [CVE-2019-15752](https://insights.sbomify.com/CVE-2019-15752/): Docker Desktop Community Edition Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2022-37021](https://insights.sbomify.com/CVE-2022-37021/): Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8. (critical 9.8)
- [CVE-2014-0048](https://insights.sbomify.com/CVE-2014-0048/): Supply chain in docker.io (critical 9.8)
- [CVE-2017-15692](https://insights.sbomify.com/CVE-2017-15692/): Apache Geode unsafe deserialization in TcpServer (critical 9.8)
- [CVE-2025-47410](https://insights.sbomify.com/CVE-2025-47410/): Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system (high 8.8)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2020-1938 and fix it if it is affected.

What it is: CVE-2020-1938 is a critical vulnerability in Apache Tomcat, published on 24 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: Yes. Attackers have exploited CVE-2020-1938 in the wild since at least 3 Mar 2022.

Affected packages and fixed versions:
- org.apache.tomcat.embed:tomcat-embed-core (Maven): affected from 7.0.0; fixed in 7.0.100
- org.apache.tomcat.embed:tomcat-embed-core (Maven): affected from 7.0.0; fixed in 7.0.100
- org.apache.tomcat.embed:tomcat-embed-core (Maven): affected from 8.0.0; fixed in 8.5.51
- org.apache.tomcat.embed:tomcat-embed-core (Maven): affected from 8.0.0; fixed in 8.5.51
- org.apache.tomcat.embed:tomcat-embed-core (Maven): affected from 9.0.0; fixed in 9.0.31
- org.apache.tomcat.embed:tomcat-embed-core (Maven): affected from 9.0.0; fixed in 9.0.31
- tomcat (Bitnami): affected from 7.0.0; fixed in 7.0.100, 8.5.51, 9.0.31

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2020-1938/ (Markdown: https://insights.sbomify.com/CVE-2020-1938/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2020-1938
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2020-1938
- OSV: https://osv.dev/vulnerability/CVE-2020-1938

---
From sbomify Insights: https://insights.sbomify.com/CVE-2020-1938/
Summaries are generated and may contain mistakes; the official description above is the record.