S4E just found a high-severity finding from top 10 tcp port service scan
PlatformPlansPartners
Resources
ToolsBlogDocs
Labs
CVE ForecastOpservantAll Research →
Sign Up →
critical·Product Based Web Vulnerabilities·Updated Jan 8, 2024

CVE-2020-1938 Scanner

Detects 'Code Injection' vulnerability in Apache Tomcat affects v. Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50, 7.0.0 to 7.0.99.

Est. Time~10 seconds
Scan TypeSingle Scan
Targetsdomain, ipv4, subdomain
CostFree
3.1k
Times Used
continuous scan runs
4.7k
Continuously Checked
assets under CS
4
Vulnerabilities Found
confirmed findings
References
🔴
CISA Known Exploited Vulnerability
This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.
CVECVE-2020-1938
9.8
CVSScritical
Exploitable remotely over the internet · no authentication required.

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
Apache Tomcatby Apache
Apache Tomcat 9.0.0.M1 to 9.0.0.30
Updated Aug 21, 2026View on NVD →
Detail

Apache Tomcat is an open-source web server and Servlet container that is widely used to run Java server pages (JSPs) and Java Servlets. It is popular because of its various features, including cross-platform compatibility, scalability, and reliability. It supports multiple add-ons and provides a versatile platform that can be easily customized as per the user's requirements. Apache Tomcat is used primarily to run web applications and is a critical component of many enterprise-grade systems.

CVE-2020-1938 is a security vulnerability found in Apache Tomcat software versions 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50, and 7.0.0 to 7.0.99. It is an AJP vulnerability that occurs when an attacker is allowed access to an AJP port. Such AJP connections are treated with higher trust than HTTP connections by Tomcat. As a result, if an attacker gains access to an AJP port, they can exploit it to return arbitrary files from the web application and process any file in the web application as a JSP. 

The CVE-2020-1938 vulnerability, when exploited, can lead to remote code execution. If an application allows file uploads and stores them within the web application, and an attacker can upload a file, this vulnerability could be potent as the uploader can execute arbitrary code remotely. Further, an attacker can also use this vulnerability to obtain sensitive information from the web application or even modify it.

s4e.io, a security platform, provides access to valuable information and resources that would help individuals and enterprises to ensure that their systems and networks remain secure against digital threats. Thanks to the intuitive user interface and the free vulnerability scan feature on s4e.io, readers can quickly and easily identify any vulnerabilities in their digital assets and take appropriate actions to mitigate them before any security incidents occur. The platform provides users access to expert insights, detailed reports on detected vulnerabilities, and recommendations on how to fix them, allowing them to stay ahead of cyber attackers.

 

REFERENCES

Solution Advice

There are several steps that one can take to protect their systems from this vulnerability:

  • The recommended approach is to disable the AJP Connector connection if it is not required, as outlined in the security guide.
  • Additionally, the user could upgrade to the latest Apache Tomcat version i.e., 9.0.31, 8.5.51, or 7.0.100, which addresses this vulnerability.
  • Another approach includes implementing access controls in the web application to ensure that the AJP port is only accessible to authenticated users.
  • Reviewing firewall rules between the web server and any connected systems to ensure that only trusted IP addresses can access the AJP port.

Get AI-powered remediation steps tailored to your asset.

Try AI Solutions →

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

CVE-2020-1938 scanner - Code Injection vulnerability in Apache Tomcat | S4E