CVE-2020-1938 - 漏洞详情

CVE-2020-1938 (CNNVD-202002-1052)

CRITICAL 有利用代码

中文标题:

Apache Tomcat 安全漏洞

英文标题:

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to...

CVSS分数: 9.8

发布时间: 2020-02-24 21:19:18

漏洞类型: 其他

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v5

漏洞描述

中文描述:

Apache Tomcat是美国阿帕奇（Apache）基金会的一款轻量级Web应用服务器。该程序实现了对Servlet和JavaServer Page（JSP）的支持。 Apache Tomcat 7.0.100版本之前的7.*版本、8.5.51版本之前的8.*版本和9.0.31版本之前的9.*版本中的Tomcat AJP协议存在安全漏洞。攻击者可利用该漏洞读取或包含Tomcat上所有webapp目录下的任意文件，如 webapp 配置文件或源代码等。

英文描述:

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

CWE类型:

（暂无数据）

受影响产品

厂商	产品	版本	版本范围	平台	CPE
Apache	Apache Tomcat	Apache Tomcat 9.0.0.M1 to 9.0.0.30	-	-	`cpe:2.3:a:apache:apache_tomcat:apache_tomcat_9.0.0.m1_to_9.0.0.30:::::::*`
Apache	Apache Tomcat	8.5.0 to 8.5.50	-	-	`cpe:2.3:a:apache:apache_tomcat:8.5.0_to_8.5.50:::::::*`
Apache	Apache Tomcat	7.0.0 to 7.0.99	-	-	`cpe:2.3:a:apache:apache_tomcat:7.0.0_to_7.0.99:::::::*`
apache	geode	1.12.0	-	-	`cpe:2.3:a:apache:geode:1.12.0:::::::*`
apache	tomcat	*	-	-	`cpe:2.3:a:apache:tomcat::::::::`
fedoraproject	fedora	30	-	-	`cpe:2.3:o:fedoraproject:fedora:30:::::::*`
fedoraproject	fedora	31	-	-	`cpe:2.3:o:fedoraproject:fedora:31:::::::*`
fedoraproject	fedora	32	-	-	`cpe:2.3:o:fedoraproject:fedora:32:::::::*`
oracle	agile_engineering_data_management	6.2.1.0	-	-	`cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:::::::*`
oracle	agile_plm	9.3.3	-	-	`cpe:2.3:a:oracle:agile_plm:9.3.3:::::::*`
oracle	agile_plm	9.3.5	-	-	`cpe:2.3:a:oracle:agile_plm:9.3.5:::::::*`
oracle	agile_plm	9.3.6	-	-	`cpe:2.3:a:oracle:agile_plm:9.3.6:::::::*`
oracle	communications_element_manager	8.1.1	-	-	`cpe:2.3:a:oracle:communications_element_manager:8.1.1:::::::*`
oracle	communications_element_manager	8.2.0	-	-	`cpe:2.3:a:oracle:communications_element_manager:8.2.0:::::::*`
oracle	communications_element_manager	8.2.1	-	-	`cpe:2.3:a:oracle:communications_element_manager:8.2.1:::::::*`
oracle	communications_instant_messaging_server	10.0.1.4.0	-	-	`cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:::::::*`
oracle	health_sciences_empirica_inspections	1.0.1.2	-	-	`cpe:2.3:a:oracle:health_sciences_empirica_inspections:1.0.1.2:::::::*`
oracle	health_sciences_empirica_signal	7.3.3	-	-	`cpe:2.3:a:oracle:health_sciences_empirica_signal:7.3.3:::::::*`
oracle	hospitality_guest_access	4.2.0	-	-	`cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:::::::*`
oracle	hospitality_guest_access	4.2.1	-	-	`cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:::::::*`
oracle	instantis_enterprisetrack	*	-	-	`cpe:2.3:a:oracle:instantis_enterprisetrack::::::::`
oracle	mysql_enterprise_monitor	*	-	-	`cpe:2.3:a:oracle:mysql_enterprise_monitor::::::::`
oracle	siebel_ui_framework	*	-	-	`cpe:2.3:a:oracle:siebel_ui_framework::::::::`
oracle	transportation_management	6.3.7	-	-	`cpe:2.3:a:oracle:transportation_management:6.3.7:::::::*`
oracle	workload_manager	12.2.0.1	-	-	`cpe:2.3:a:oracle:workload_manager:12.2.0.1:::::::*`
oracle	workload_manager	18c	-	-	`cpe:2.3:a:oracle:workload_manager:18c:::::::*`
oracle	workload_manager	19c	-	-	`cpe:2.3:a:oracle:workload_manager:19c:::::::*`
debian	debian_linux	8.0	-	-	`cpe:2.3:o:debian:debian_linux:8.0:::::::*`
debian	debian_linux	9.0	-	-	`cpe:2.3:o:debian:debian_linux:9.0:::::::*`
debian	debian_linux	10.0	-	-	`cpe:2.3:o:debian:debian_linux:10.0:::::::*`
opensuse	leap	15.1	-	-	`cpe:2.3:o:opensuse:leap:15.1:::::::*`
blackberry	good_control	*	-	-	`cpe:2.3:a:blackberry:good_control::::::::`
blackberry	workspaces_server	7.0.1	-	-	`cpe:2.3:a:blackberry:workspaces_server:7.0.1:::::::*`
blackberry	workspaces_server	7.1.2	-	-	`cpe:2.3:a:blackberry:workspaces_server:7.1.2:::::::*`
blackberry	workspaces_server	8.1.0	-	-	`cpe:2.3:a:blackberry:workspaces_server:8.1.0:::::::*`
blackberry	workspaces_server	9.0	-	-	`cpe:2.3:a:blackberry:workspaces_server:9.0:::::::*`
netapp	data_availability_services	-	-	-	`cpe:2.3:a:netapp:data_availability_services:-:::::::*`
netapp	oncommand_system_manager	*	-	-	`cpe:2.3:a:netapp:oncommand_system_manager::::::::`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

[tomcat-announce] 20200224 [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution mailing-list
cve.org

访问

[ofbiz-notifications] 20200225 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938) mailing-list
cve.org

访问

[ofbiz-notifications] 20200225 [jira] [Updated] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938) mailing-list
cve.org

访问

[ofbiz-commits] 20200227 [ofbiz-plugins] branch release17.12 updated: Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938) (OFBIZ-11407) mailing-list
cve.org

访问

[ofbiz-notifications] 20200227 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938) mailing-list
cve.org

访问

[ofbiz-notifications] 20200228 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938) mailing-list
cve.org

访问

[ofbiz-notifications] 20200228 [jira] [Comment Edited] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938) mailing-list
cve.org

访问

[tomcat-users] 20200301 Re: [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution mailing-list
cve.org

访问

[tomcat-users] 20200302 Re: AW: [SECURITY] CVE-2020-1938 AJP Request Injection and potentialRemote Code Execution mailing-list
cve.org

访问

[tomcat-users] 20200302 AW: [SECURITY] CVE-2020-1938 AJP Request Injection and potentialRemote Code Execution mailing-list
cve.org

访问

[tomcat-users] 20200302 Re: [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution mailing-list
cve.org

访问

[tomcat-users] 20200304 Re: Fix for CVE-2020-1938 mailing-list
cve.org

访问

[tomcat-dev] 20200304 Re: Tagging 10.0.x, 9.0.x, 8.5.x mailing-list
cve.org

访问

[debian-lts-announce] 20200304 [SECURITY] [DLA 2133-1] tomcat7 security update mailing-list
cve.org

访问

[tomcat-users] 20200305 Aw: Re: Fix for CVE-2020-1938 mailing-list
cve.org

访问

[tomcat-users] 20200305 Re: Aw: Re: Fix for CVE-2020-1938 mailing-list
cve.org

访问

[tomcat-dev] 20200309 [Bug 64206] Answer file not being used mailing-list
cve.org

访问

[tomcat-users] 20200309 Re: Apache Tomcat AJP File Inclusion Vulnerability (unauthenticated check) mailing-list
cve.org

访问

[tomcat-users] 20200310 Aw: Re: Re: Fix for CVE-2020-1938 mailing-list
cve.org

访问

[tomcat-users] 20200310 Re: Re: Re: Fix for CVE-2020-1938 mailing-list
cve.org

访问

[tomee-dev] 20200311 CVE-2020-1938 on Tomcat 9.0.30 / TomEE 8.0.1 mailing-list
cve.org

访问

[tomee-dev] 20200311 Re: CVE-2020-1938 on Tomcat 9.0.30 / TomEE 8.0.1 mailing-list
cve.org

访问

openSUSE-SU-2020:0345 vendor-advisory
cve.org

访问

[tomee-dev] 20200316 RE: CVE-2020-8840 on TomEE 8.0.1 mailing-list
cve.org

访问

[httpd-bugs] 20200319 [Bug 53098] mod_proxy_ajp: patch to set worker secret passed to tomcat mailing-list
cve.org

访问

GLSA-202003-43 vendor-advisory
cve.org

访问

[tomee-commits] 20200320 [jira] [Updated] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability. mailing-list
cve.org

访问

[tomee-commits] 20200320 [jira] [Created] (TOMEE-2789) TomEE plus is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability. mailing-list
cve.org

访问

[tomee-commits] 20200323 [jira] [Commented] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability. mailing-list
cve.org

访问

FEDORA-2020-0e42878ba7 vendor-advisory
cve.org

访问

FEDORA-2020-c870aa8378 vendor-advisory
cve.org

访问

FEDORA-2020-04ac174fa9 vendor-advisory
cve.org

访问

[tomcat-users] 20200413 RE: Alternatives for AJP mailing-list
cve.org

访问

openSUSE-SU-2020:0597 vendor-advisory
cve.org

访问

DSA-4673 vendor-advisory
cve.org

访问

DSA-4680 vendor-advisory
cve.org

访问

[debian-lts-announce] 20200528 [SECURITY] [DLA 2209-1] tomcat8 security update mailing-list
cve.org

访问

[tomcat-dev] 20200625 svn commit: r1879208 - in /tomcat/site/trunk: docs/security-10.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-8.xml xdocs/security-9.xml mailing-list
cve.org

访问

[ofbiz-notifications] 20200628 [jira] [Updated] (OFBIZ-11847) CLONE - Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996) mailing-list
cve.org

访问

[ofbiz-notifications] 20200628 [jira] [Created] (OFBIZ-11847) CLONE - Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996) mailing-list
cve.org

访问

无标题 x_refsource_MISC
cve.org

访问

无标题 x_refsource_CONFIRM
cve.org

访问

无标题 x_refsource_CONFIRM
cve.org

访问

[tomee-users] 20200723 Re: TomEE on Docker mailing-list
cve.org

访问

[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12 mailing-list
cve.org

访问

无标题 x_refsource_MISC
cve.org

访问

[tomee-commits] 20201127 [jira] [Resolved] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability. mailing-list
cve.org

访问

[tomee-commits] 20201127 [jira] [Updated] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability. mailing-list
cve.org

访问

无标题 x_refsource_MISC
cve.org

访问

[announce] 20210125 Apache Software Foundation Security Report: 2020 mailing-list
cve.org

访问

[announce] 20210223 Re: Apache Software Foundation Security Report: 2020 mailing-list
cve.org

访问

134c704f-9b21-4f2e-91b3-4a467353bcc0 OTHER
nvd.nist.gov

访问

ExploitDB EDB-48143 EXPLOIT
exploitdb

访问

Download Exploit EDB-48143 EXPLOIT
exploitdb

访问

CVE Reference: CVE-2020-1938 ADVISORY
cve.org

访问

ExploitDB EDB-49039 EXPLOIT
exploitdb

访问

Download Exploit EDB-49039 EXPLOIT
exploitdb

访问

CVSS评分详情

3.1 (adp)

CRITICAL

9.8

CVSS向量: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

机密性

HIGH

完整性

HIGH

可用性

HIGH

时间信息

发布时间:

2020-02-24 21:19:18

修改时间:

2025-10-21 23:35:50

创建时间:

2025-11-11 15:36:09

更新时间:

2025-11-11 16:55:54

利用信息

此漏洞有可利用代码！

利用代码数量: 2

利用来源:

未知未知

数据源详情

数据源	记录ID	版本	提取时间
CVE	`cve_CVE-2020-1938`	2025-11-11 15:20:28	2025-11-11 07:36:09
NVD	`nvd_CVE-2020-1938`	2025-11-11 14:56:55	2025-11-11 07:44:35
CNNVD	`cnnvd_CNNVD-202002-1052`	2025-11-11 15:10:22	2025-11-11 07:55:25
EXPLOITDB	`exploitdb_EDB-48143`	2025-11-11 15:05:28	2025-11-11 08:53:49
EXPLOITDB	`exploitdb_EDB-49039`	2025-11-11 15:05:28	2025-11-11 08:55:54

版本与语言

当前版本: v5

主要语言: EN

支持语言:

EN ZH

其他标识符:

安全公告

暂无安全公告信息

变更历史

v5 EXPLOITDB

2025-11-11 16:55:54

references_count: 55 → 57; tags_count: 3 → 4

查看详细变更

references_count: 55 -> 57
tags_count: 3 -> 4

v4 EXPLOITDB

2025-11-11 16:53:49

references_count: 52 → 55; tags_count: 0 → 3; data_sources: ['cnnvd', 'cve', 'nvd'] → ['cnnvd', 'cve', 'exploitdb', 'nvd']

查看详细变更

references_count: 52 -> 55
tags_count: 0 -> 3
data_sources: ['cnnvd', 'cve', 'nvd'] -> ['cnnvd', 'cve', 'exploitdb', 'nvd']

v3 CNNVD

2025-11-11 15:55:25

vulnerability_type: 未提取 → 其他; cnnvd_id: 未提取 → CNNVD-202002-1052; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']

查看详细变更

vulnerability_type: 未提取 -> 其他
cnnvd_id: 未提取 -> CNNVD-202002-1052
data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']

v2 NVD

2025-11-11 15:44:35

affected_products_count: 3 → 38; references_count: 51 → 52; data_sources: ['cve'] → ['cve', 'nvd']

查看详细变更

affected_products_count: 3 -> 38
references_count: 51 -> 52
data_sources: ['cve'] -> ['cve', 'nvd']

CVE-2020-1938 (CNNVD-202002-1052)

中文标题:

Apache Tomcat 安全漏洞

英文标题:

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to...

漏洞描述

中文描述:

英文描述:

CWE类型:

标签:

受影响产品

解决方案

中文解决方案:

英文解决方案:

临时解决方案:

参考链接

CVSS评分详情

3.1 (adp)

时间信息

利用信息

数据源详情

版本与语言

安全公告

变更历史