Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
5
CVSSv2

CVE-2007-1860

Published: 25/05/2007 Updated: 13/02/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 446
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Subscribe to Apache

Vulnerability Summary

mod_jk in Apache Tomcat JK Web Server Connector 1.2.x prior to 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote malicious users to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apache tomcat jk web server connector

Vendor Advisories

Debian CVElist Bug Report Logs: [CVE-2007-1860] A double encoded ".." in a URL can be used to access URLs on the AJP backend
Debian Bug report logs - #425836 [CVE-2007-1860] A double encoded "" in a URL can be used to access URLs on the AJP backend Package: libapache2-mod-jk; Maintainer for libapache2-mod-jk is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Source for libapache2-mod-jk is src:libapache-mod-jk (PTS, buildd, popco ...
Debian Security Advisories: DSA-1312-1 libapache-mod-jk -- programming error
It was discovered that the Apache 13 connector for the Tomcat Java servlet engine decoded request URLs multiple times, which can lead to information disclosure For the oldstable distribution (sarge) this problem has been fixed in version 125-2sarge1 An updated package for powerpc is not yet available due to problems with the build host It wil ...

Github Repositories

https://github.com/sagardevopss/sample_web_app

This is my first web app

tomcatWarDeployer Apache Tomcat auto WAR deployment & pwning penetration testing tool What is it? This is a penetration testing tool intended to leverage Apache Tomcat credentials in order to automatically generate and deploy JSP Backdoor, as well as invoke it afterwards and provide nice shell (either via web gui, listening port binded on remote machine or as a reverse

https://github.com/mgeeky/tomcatWarDeployer

Apache Tomcat auto WAR deployment & pwning penetration testing tool.

tomcatWarDeployer Apache Tomcat auto WAR deployment & pwning penetration testing tool What is it? This is a penetration testing tool intended to leverage Apache Tomcat credentials in order to automatically generate and deploy JSP Backdoor, as well as invoke it afterwards and provide nice shell (either via web gui, listening port binded on remote machine or as a reverse

https://github.com/sagardevopss/simple-maker

tomcatWarDeployer Apache Tomcat auto WAR deployment & pwning penetration testing tool What is it? This is a penetration testing tool intended to leverage Apache Tomcat credentials in order to automatically generate and deploy JSP Backdoor, as well as invoke it afterwards and provide nice shell (either via web gui, listening port binded on remote machine or as a reverse

https://github.com/yingshang/sturoad

安全工程师学习之路

甲方安全体系建设 代码审计 甲方安全中心建设：代码审计系统 基于Fortify的自动化代码审计平台 渗透 甲方安全中心建设：渗透测试系统 漏洞记录 渗透测试-漏洞列表 业务逻辑-高并发漏洞 有趣的暴力破解漏洞 不一样的SQL注入 安全培训 安全培训平台-阴阳 蜜罐 开源蜜罐测评报告 蜜罐捕

References

CWE-22http://tomcat.apache.org/connectors-doc/news/20070301.html#20070518.1http://tomcat.apache.org/security-jk.htmlhttp://secunia.com/advisories/25383http://docs.info.apple.com/article.html?artnum=306172http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.htmlhttp://www.debian.org/security/2007/dsa-1312http://security.gentoo.org/glsa/glsa-200708-15.xmlhttp://www.redhat.com/support/errata/RHSA-2007-0379.htmlhttp://www.securityfocus.com/bid/24147http://www.securityfocus.com/bid/25159http://www.osvdb.org/34877http://www.securitytracker.com/id?1018138http://secunia.com/advisories/25701http://secunia.com/advisories/26235http://secunia.com/advisories/26512http://secunia.com/advisories/27037http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.htmlhttp://secunia.com/advisories/29242http://www.redhat.com/support/errata/RHSA-2008-0261.htmlhttp://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795http://www.vupen.com/english/advisories/2007/2732http://www.vupen.com/english/advisories/2007/1941http://www.vupen.com/english/advisories/2007/3386https://exchange.xforce.ibmcloud.com/vulnerabilities/34496https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6002https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3Ehttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=425836https://nvd.nist.govhttps://github.com/sagardevopss/sample_web_apphttps://www.debian.org/security/./dsa-1312
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-3675CVE-2024-3400CVE-2024-23557mass assignmentCVE-2023-1389local file inclusionCVE-2024-32596file uploadCVE-2024-32593
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook