mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Tomcat | — | Apply OS X security update 2007-007 | Dec 16, 2011 | May 25, 2007 |
| Debian | — | Upgrade libapache-mod-jk | Jul 30, 2024 | May 25, 2007 |
| Freebsd | — | Upgrade mod_jkUpgrade mod_jk-ap2 | Dec 10, 2025 | Jun 5, 2007 |
| Gentoo Linux | — | Upgrade www-apache/mod_jk. | Oct 30, 2017 | May 25, 2007 |
| Hpux | — | Update hpuxwsAPACHE to the latest version | Aug 11, 2017 | May 25, 2007 |
| Suse | — | Upgrade jakarta-tomcatUpgrade tomcat55-jasperUpgrade tomcat55-jsp-2_0-api-javadocUpgrade tomcat55-common-libUpgrade tomcat55-jsp-2_0-apiUpgrade apache-jakarta-tomcat-connectorsUpgrade tomcat55-jasper-javadocUpgrade tomcat55Upgrade suse-releaseUpgrade tomcat5-admin-webappsUpgrade tomcat55-servlet-2_4-apiUpgrade tomcat55-server-libUpgrade jakarta-tomcat-docUpgrade tomcat5Upgrade tomcat5-webappsUpgrade tomcat55-admin-webappsUpgrade tomcat55-webappsUpgrade jakarta-tomcat-examplesUpgrade tomcat55-servlet-2_4-api-javadocUpgrade apache2-jakarta-tomcat-connectorsUpgrade apache2-mod_jk | Feb 17, 2015 | May 25, 2007 |
| Ubuntu | — | Upgrade libapache-mod-jk | Nov 19, 2024 | May 25, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub