CVE-2007-1860

MEDIUM 5.0CVE-2007-1860 · Published 25/05/2007 · updated 16/06/2026

Package	Affected versions	Patched versions
tomcat jk web server connector apache	`≤ 1.2.22`	No fix yet

Description

mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.

References

docs.info.apple.com/article.html
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp
lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html
secunia.com/advisories/25383 · Patch
secunia.com/advisories/25701 · Vendor Advisory
secunia.com/advisories/26235 · Vendor Advisory
secunia.com/advisories/26512 · Vendor Advisory
secunia.com/advisories/27037 · Vendor Advisory
secunia.com/advisories/29242 · Vendor Advisory
security.gentoo.org/glsa/glsa-200708-15.xml
tomcat.apache.org/connectors-doc/news/20070301.html · Patch
tomcat.apache.org/security-jk.html · Patch
debian.org/security/2007/dsa-1312
osvdb.org/34877
redhat.com/support/errata/RHSA-2007-0379.html · Vendor Advisory
redhat.com/support/errata/RHSA-2008-0261.html
securityfocus.com/bid/24147
securityfocus.com/bid/25159
securitytracker.com/id
vupen.com/english/advisories/2007/1941 · Vendor Advisory
vupen.com/english/advisories/2007/2732 · Vendor Advisory
vupen.com/english/advisories/2007/3386 · Vendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/34496
lists.apache.org/thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E
lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6002

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free