mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Tomcat | — | Apply OS X security update 2007-007 | Dec 16, 2011 | May 25, 2007 |
| Debian | — | Upgrade libapache-mod-jk | Jul 30, 2024 | May 25, 2007 |
| Freebsd | — | Upgrade mod_jkUpgrade mod_jk-ap2 | Dec 10, 2025 | Jun 5, 2007 |
| Gentoo Linux | — | Upgrade www-apache/mod_jk. | Oct 30, 2017 | May 25, 2007 |
| Hpux | — | Update hpuxwsAPACHE to the latest version | Aug 11, 2017 | May 25, 2007 |
| Suse | — | Upgrade tomcat55Upgrade tomcat55-server-libUpgrade tomcat55-webappsUpgrade apache2-jakarta-tomcat-connectorsUpgrade tomcat5-webappsUpgrade tomcat55-jasper-javadocUpgrade tomcat5-admin-webappsUpgrade tomcat5Upgrade tomcat55-admin-webappsUpgrade tomcat55-servlet-2_4-apiUpgrade jakarta-tomcat-examplesUpgrade jakarta-tomcat-docUpgrade suse-releaseUpgrade apache2-mod_jkUpgrade tomcat55-servlet-2_4-api-javadocUpgrade jakarta-tomcatUpgrade tomcat55-jasperUpgrade tomcat55-jsp-2_0-api-javadocUpgrade tomcat55-common-libUpgrade tomcat55-jsp-2_0-apiUpgrade apache-jakarta-tomcat-connectors | Feb 17, 2015 | May 25, 2007 |
| Ubuntu | — | Upgrade libapache-mod-jk | Nov 19, 2024 | May 25, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub