CVE-2020-1938
Published: March 3, 2022
Official Description
Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.
CISA KEV Advisory
Apache Tomcat Improper Privilege Management Vulnerability
Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.
Apply updates per vendor instructions.
Risk Analysis
Apache Tomcat treats AJP connections with higher trust, making them exploitable if accessible to an attacker. This can lead to various security issues. The high EPSS score of 0.94469 indicates a very high probability of exploitation, requiring immediate attention.
This vulnerability is actively exploited in the wild and is included in CISA's KEV catalog, confirming its active use by attackers.
Configure Apache Tomcat to restrict AJP connections to trusted sources or disable AJP if not in use, and apply the latest security updates.
Technical Analysis
CVE-2020-1938 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2020-1938 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Affected Vendors & Products
Exploit & PoC Resources
All References (1)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2020-1938 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1