The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via IIS, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing Tomcat via the reverse proxy.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Oracle Solaris | — | Upgrade web/server/apache-24/module/apache-jk to version 1.2.46-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Mar 12, 2018 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Mar 13, 2018 |
| Suse | — | Upgrade apache2-mod_jk | Feb 4, 2022 | Mar 12, 2018 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub