CriticalCVE-2020-1938

    Apache Tomcat Improper Privilege Management Vulnerability (CVE-2020-1938)

    Published Last modified In CISA KEV since Sources: SingCERT, OSV, CVE.org, Red Hat

    What is affected, what to do

    When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection.

    The vulnerability is being actively exploited; treat it as a priority. Update tomcat to version 8.5.51. Immediate actions, mitigation and detection rules are in the runbook below.

    Affected
    • Apache Tomcat eq Apache Tomcat 9.0.0.M1 to 9.0.0.30..Apache Tomcat 9.0.0.M1 to 9.0.0.30
    • Apache Tomcat eq 8.5.0 to 8.5.50..8.5.0 to 8.5.50
    • Apache Tomcat eq 7.0.0 to 7.0.99..7.0.0 to 7.0.99

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    9.8

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: NVD, CVSS v3

    9.8

    CVSS v3

    Severity Critical on the scale from 0 to 10.

    Source: SingCERT, OSV, CVE.org, Red Hat

    99.27 %

    EPSS score

    High — model estimates ≥ 50% chance of real-world exploitation within 30 days.

    Source: FIRST EPSS, percentile 99.94

    Show all metrics
    Severity
    Critical
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    228.90 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    actively exploited
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    9.8 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    9.8
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    99.27 %
    High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    99.94
    Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    Actively exploited
    Published
    In CISA KEV since

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary

    Response and mitigation

    Why act now?

    Prioritisation rationale

    Ghostcat is network-reachable without authentication or user interaction. Public exploits have circulated since 2020, are baked into mass scanners, and the vulnerability sits among the CVEs most likely to be exploited. Typical victims are legacy Tomcat estates, vendor appliances and business applications with bundled Tomcat where the default all-interfaces AJP connector was never disabled. CISA does not flag known ransomware use. Treat internet-reachable 8009/tcp as critical and act immediately; rate internally reachable AJP as high. Loopback-only AJP behind a proxy can follow the normal patch cycle.

    1. Runbook step 1

      Immediate response (0-24 h)

      • Find exposed AJP listeners: Scan externally and internally (e.g. nmap -p 8009 --open -sV) for reachable AJP connectors. The default port is 8009/tcp. To catch non-default ports, grep server.xml for protocol="AJP/1.3".
      • Block AJP at the edge now: Deny 8009/tcp at perimeter firewalls, cloud security groups and host firewalls. Only the fronting reverse proxy (Apache httpd mod_jk/mod_proxy_ajp, IIS connector) should be allowed through.
      • Patch: Upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. The hardened default binds AJP to loopback and requires a secret. Expect to adjust proxy-side secret/secretRequired settings before rollout.
      • Disable AJP where unused: Comment out <Connector port="8009" protocol="AJP/1.3" … /> in conf/server.xml and restart Tomcat. This is the single most effective quick fix.
      • Inventory embedded Tomcat: The context also lists Apache Geode 1.12.0 and BlackBerry Good Control 5.2.58.38 as affected. Patches are available from each vendor — check the vendor advisory for the fixed version. Query owners of appliances and line-of-business apps that bundle Tomcat.
      • Rotate secrets if exposed: If AJP was reachable from untrusted networks, assume every file in the web application was readable. That includes WEB-INF/web.xml, WEB-INF/classes/*.properties and any DB or API credentials stored there. Rotate those credentials.

    2. Runbook step 2

      Mitigation layers

      • Network segmentation: Restrict AJP to proxy-to-Tomcat traffic on a dedicated backend VLAN. Add an explicit deny on 8009/tcp from user, client and DMZ segments.
      • Configuration hardening (if upgrade is delayed): Set address="127.0.0.1" (or the proxy IP) on the connector. Configure a strong shared secret: requiredSecret on older builds, secret plus secretRequired="true" on fixed releases.
      • IPS rule: Enable signatures on 8009/tcp that match AJP request attributes javax.servlet.include.request_uri, javax.servlet.include.path_info or javax.servlet.include.servlet_path. Suricata/ET Open rulesets ship Ghostcat signatures; look up the SID in your current ruleset.
      • Application hardening: Store uploads outside webapps/ and the web root. This breaks the file-inclusion plus JSP-processing chain that leads to RCE.
      • Host least privilege: Run Tomcat under a dedicated unprivileged service account. Remove that account's write access to webapps/ and conf/.

    3. Runbook step 3

      Detection rules

      • Network telemetry (Zeek/firewall): Alert on 8009/tcp sessions from sources outside the proxy allowlist, e.g. in SPL: index=fw dest_port=8009 action=allowed NOT src_ip IN (<proxy_ips>) | stats count by src_ip, dest_ip.
      • Suricata payload pattern: Match TCP payloads on 8009 containing the AJP magic 0x1234 and the string javax.servlet.include.. Treat a hit as a high-confidence exploit attempt, especially when the payload also references WEB-INF/web.xml.
      • Process ancestry (EDR/Sysmon EID 1, auditd execve): Alert on shells spawned by Tomcat, e.g. in KQL: DeviceProcessEvents | where InitiatingProcessFileName in~ ("java.exe","tomcat9.exe","tomcat8.exe","tomcat7.exe") and FileName in~ ("cmd.exe","powershell.exe","sh","bash").
      • Web-root file writes (Sysmon EID 11, auditd -w <CATALINA_BASE>/webapps -p wa): Alert on new or modified .jsp, .jspx or .txt files in application upload directories.
      • Tomcat access logs: Review AJP-served requests for odd targets such as uploaded files or images that return 200 with unexpected response sizes.

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

    Source: CSA/SingCERT, OSV (Open Source Vulnerabilities), cvelistv5, CISA KEV Catalog, NVD (NIST), redhat_csaf

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    ApacheApache Tomcat
    • 7.0.0 to 7.0.99
    • Apache Tomcat 9.0.0.M1 to 9.0.0.30
    • 8.5.0 to 8.5.50
    • —
    • —
    • —
    apachegeode
    • 1.12.0
    • —
    apachetomcat
    • 8.5.0 – < 8.5.51
    • 7.0.0 – < 7.0.100
    • 9.0.0 – < 9.0.31
    • 8.5.51
    • 7.0.100
    • 9.0.31
    blackberrygood_control
    • ≤ 5.2.58.38
    • —
    blackberryworkspaces_server
    • 7.1.2
    • 9.0
    • 7.0.1
    • 8.1.0
    • —
    • —
    • —
    • —
    netappdata_availability_services
    • —
    • —
    netapponcommand_system_manager
    • 3.0.0 – ≤ 3.1.3
    • —
    oracleagile_engineering_data_management
    • 6.2.1.0
    • —
    oracleagile_product_lifecycle_management
    • 9.3.3
    • 9.3.5
    • 9.3.6
    • —
    • —
    • —
    oraclecommunications_element_manager
    • 8.2.1
    • 8.1.1
    • 8.2.0
    • —
    • —
    • —
    oraclecommunications_instant_messaging_server
    • 10.0.1.4.0
    • —
    oraclehealth_sciences_empirica_inspections
    • 1.0.1.2
    • —
    oraclehealth_sciences_empirica_signal
    • 7.3.3
    • —
    oraclehospitality_guest_access
    • 4.2.0
    • 4.2.1
    • —
    • —
    oracleinstantis_enterprisetrack
    • 17.1 – ≤ 17.3
    • —
    oraclemysql_enterprise_monitor
    • 8.0.0 – ≤ 8.0.20
    • ≤ 4.0.12
    • —
    • —
    oraclesiebel_ui_framework
    • ≤ 20.5
    • —
    oracletransportation_management
    • 6.3.7
    • —
    oracleworkload_manager
    • 18c
    • 12.2.0.1
    • 19c
    • —
    • —
    • —
    mavenorg.apache.tomcat.embed:tomcat-embed-core
    • 7.0.30
    • 7.0.75
    • 7.0.84
    • 8.0.18
    • 8.0.27
    • 8.0.36
    • 8.0.8
    • 7.0.47
    • 7.0.40
    • 8.5.3
    • 9.0.1
    • 8.5.34
    • 8.5.23
    • 8.5.35
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —
    • —

    Vendors and products

    Affected operating systems

    Affected operating systems
    Linuxdebiandebian_linux10.0
    Linuxdebiandebian_linux8.0
    Linuxdebiandebian_linux9.0
    Linuxopensuseleap15.1
    Otherfedoraprojectfedora30
    Otherfedoraprojectfedora31
    Otherfedoraprojectfedora32

    Public exploit references

    Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

    Public exploit references
    CISA KEV CatalogCISA Known Exploited Vulnerability (opens in a new tab)cisa.govactively exploited
    PoC-in-GitHub (nomi-sec)vulhub-tomcat-cve-2020-1938 (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)tomcatfileread (opens in a new tab)github.comPoC (publicly reported)reported, not verified
    PoC-in-GitHub (nomi-sec)Tomcat-AJP-CVE-2020-1938 (opens in a new tab)github.comPoC (publicly reported)reported, not verified

    References & sources

    • NVD (NIST)vuln/detail/CVE-2020-1938advisory
    • lists.apache.orgthread.html/re5eecbe5bf967439bafeeaa85987b3a43f0e6efe06b6976ee7…web
    • lists.apache.org[tomcat-users] 20200305 Aw: Re: Fix for CVE-2020-1938web, Mailing list, x_refsource_MLIST
    • lists.apache.orgthread.html/rd50baccd1bbb96c2327d5a8caa25a49692b3d68d96915bd1cf…web
    • lists.apache.org[tomcat-users] 20200302 Re: [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Executionweb, Mailing list, x_refsource_MLIST
    • lists.apache.orgthread.html/rd0774c95699d5aeb5e16e9a600fb2ea296e81175e30a62094e…web
    • lists.apache.org[ofbiz-commits] 20200227 [ofbiz-plugins] branch release17.12 updated: Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938) (OFBIZ-11407)web, Mailing list, x_refsource_MLIST
    • lists.apache.orgthread.html/rce2af55f6e144ffcdc025f997eddceb315dfbc0b230e3d750a…web
    • lists.apache.org[ofbiz-notifications] 20200228 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)web, Mailing list, x_refsource_MLIST
    • lists.apache.orgthread.html/rcd5cd301e9e7e39f939baf2f5d58704750be07a5e2d3393e40…web
    • lists.apache.org[tomee-commits] 20200320 [jira] [Updated] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.web, Mailing list, x_refsource_MLIST
    • lists.apache.orgthread.html/rc068e824654c4b8bd4f2490bec869e29edbfcd5dfe02d47cbf…web
    • lists.apache.org[tomee-dev] 20200316 RE: CVE-2020-8840 on TomEE 8.0.1web, Mailing list, x_refsource_MLIST
    • lists.apache.orgthread.html/rbdb1d2b651a3728f0ceba9e0853575b6f90296a94a71836a15…web
    • lists.apache.org[tomee-dev] 20200311 Re: CVE-2020-1938 on Tomcat 9.0.30 / TomEE 8.0.1web, Mailing list, x_refsource_MLIST
    • lists.apache.orgthread.html/rb2fc890bef23cbc7f343900005fe1edd3b091cf18dada45558…web
    • lists.apache.org[tomcat-users] 20200301 Re: [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Executionweb, Mailing list, x_refsource_MLIST
    • lists.apache.orgthread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f5808…web
    • lists.apache.org[tomcat-dev] 20200625 svn commit: r1879208 - in /tomcat/site/trunk: docs/security-10.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-8.xml xdocs/security-9.xmlweb, Mailing list, x_refsource_MLIST
    • lists.apache.orgthread.html/rad36ec6a1ffc9e43266b030c22ceeea569243555d34fb4187f…web

    Changes to this CVE

    Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

    1. Product identifiers remappedNVD

      Product mapping changed:
      Show the original change
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Product configurationchanged
      OR *cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*
      OR *cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:*

      Source identifier: nvd@nist.gov

    2. Product identifiers remappedNVD

      Product mapping changed:
      Show the original change
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Product configurationchanged
      OR *cpe:2.3:a:oracle:agile_plm:9.3.5:*:*:*:*:*:*:*
      OR *cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:*

      Source identifier: nvd@nist.gov

    3. Product identifiers remappedNVD

      Product mapping changed:
      Show the original change
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Product configurationchanged
      OR *cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
      OR *cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*

      Source identifier: nvd@nist.gov

    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2020-1938
    <a href="https://intel.neosec.eu/en/cve/CVE-2020-1938"><img src="https://intel.neosec.eu/badge/cve/CVE-2020-1938.svg?lang=en" alt="CVE-2020-1938 – NEOSEC Intel" height="20"></a>