CVE-2007-1860

Apache Tomcat JK Web Server Connector < 1.2.23 - Path Traversal via Double-Encoded URL Prefix

Title source: llm

Description

mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.

References (34)

Core 34

Core References

Mailing List vendor-advisory x_refsource_apple

http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c%40%3Cdev.tomcat.apache.org%3E

Third Party Advisory vendor-advisory x_refsource_gentoo

http://security.gentoo.org/glsa/glsa-200708-15.xml

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2007/dsa-1312

Vendor Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2007/2732

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6002

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/25701

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/29242

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/24147

Patch, Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/25383

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://www.osvdb.org/34877

Vendor Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2007/1941

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2007-0379.html

Vendor Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2007/3386

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1018138

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/27037

Vendor Advisory x_refsource_confirm

http://docs.info.apple.com/article.html?artnum=306172

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/26512

Vendor Advisory vendor-advisory x_refsource_hp

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795

Patch x_refsource_misc

http://tomcat.apache.org/connectors-doc/news/20070301.html#20070518.1

Patch x_refsource_confirm

http://tomcat.apache.org/security-jk.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/25159

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2008-0261.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/34496

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/26235

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925%40%3Cdev.tomcat.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomcat.apache.org%3E

Scores

EPSS 0.1292

EPSS Percentile 95.8%

Details

CWE

CWE-22

Status published

Products (1)

apache/tomcat_jk_web_server_connector < 1.2.22

Published May 25, 2007

Tracked Since Feb 18, 2026