[Forgot Password]
Login  Register Subscribe

24003

 
 

131401

 
 

103942

 
 

909

 
 

84044

 
 

133

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML view JSON

CVE-2007-1860Date: (C)2007-05-25   (M)2018-02-19


mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V3 Severity:CVSS V2 Severity:
CVSS Score : CVSS Score : 5.0
Exploit Score: Exploit Score: 10.0
Impact Score: Impact Score: 2.9
 
CVSS V3 Metrics:CVSS V2 Metrics:
Attack Vector: Access Vector: NETWORK
Attack Complexity: Access Complexity: LOW
Privileges Required: Authentication: NONE
User Interaction: Confidentiality: PARTIAL
Scope: Integrity: NONE
Confidentiality: Availability: NONE
Integrity:  
Availability:  
  
Reference:
SECTRACK-1018138
BID-24147
BID-25159
SECUNIA-25383
SECUNIA-25701
SECUNIA-26235
SECUNIA-26512
SECUNIA-27037
SECUNIA-29242
OSVDB-34877
ADV-2007-1941
ADV-2007-2732
ADV-2007-3386
APPLE-SA-2007-07-31
DSA-1312
GLSA-200708-15
HPSBUX02262
RHSA-2007:0379
RHSA-2008:0261
SSRT071447
SUSE-SR:2008:005
http://docs.info.apple.com/article.html?artnum=306172
http://tomcat.apache.org/connectors-doc/news/20070301.html#20070518.1
http://tomcat.apache.org/security-jk.html
tomcat-jkconnector-security-bypass(34496)

CPE    1
cpe:/a:apache:tomcat_jk_web_server_connector:1.2.22
CWE    1
CWE-22

© 2013 SecPod Technologies