mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Tomcat | — | Apply OS X security update 2007-007 | Dec 16, 2011 | May 25, 2007 |
| Debian | — | Upgrade libapache-mod-jk | Jul 30, 2024 | May 25, 2007 |
| Freebsd | — | Upgrade mod_jk-ap2Upgrade mod_jk | Dec 10, 2025 | Jun 5, 2007 |
| Gentoo Linux | — | Upgrade www-apache/mod_jk. | Oct 30, 2017 | May 25, 2007 |
| Hpux | — | Update hpuxwsAPACHE to the latest version | Aug 11, 2017 | May 25, 2007 |
| Suse | — | Upgrade tomcat55-server-libUpgrade apache2-jakarta-tomcat-connectorsUpgrade tomcat5-webappsUpgrade jakarta-tomcat-docUpgrade tomcat55-jasper-javadocUpgrade jakarta-tomcat-examplesUpgrade tomcat55-admin-webappsUpgrade tomcat5-admin-webappsUpgrade tomcat5Upgrade tomcat55Upgrade tomcat55-servlet-2_4-api-javadocUpgrade tomcat55-webappsUpgrade tomcat55-servlet-2_4-apiUpgrade suse-releaseUpgrade apache2-mod_jkUpgrade apache-jakarta-tomcat-connectorsUpgrade tomcat55-jasperUpgrade tomcat55-jsp-2_0-api-javadocUpgrade tomcat55-jsp-2_0-apiUpgrade tomcat55-common-libUpgrade jakarta-tomcat | Feb 17, 2015 | May 25, 2007 |
| Ubuntu | — | Upgrade libapache-mod-jk | Nov 19, 2024 | May 25, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub