Dashboard / CVE-2020-1938

CVE-2020-1938

CISA KEV
ACT NOW Priority: 0.00 BB Relevance: 0/100
Published: N/A Modified: N/A First seen: 2026-10-29 Status: pending_score

Description

Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.

CISA Known Exploited Vulnerability

Vendor / Product Apache — Tomcat
Date Added 2022-03-03
Remediation Due 2022-03-17
https://nvd.nist.gov/vuln/detail/CVE-2020-1938

Affected Software (38)

VendorProductVersion
apache geode 1.12.0
apache tomcat 7.0.0 – 7.0.100
apache tomcat 8.5.0 – 8.5.51
apache tomcat 9.0.0 – 9.0.31
blackberry good_control < 5.2.58.38
blackberry workspaces_server 7.0.1
blackberry workspaces_server 7.1.2
blackberry workspaces_server 8.1.0
blackberry workspaces_server 9.0
debian debian_linux 8.0
debian debian_linux 9.0
debian debian_linux 10.0
fedoraproject fedora 30
fedoraproject fedora 31
fedoraproject fedora 32
netapp data_availability_services -
netapp oncommand_system_manager 3.0.0 – 3.1.3
opensuse leap 15.1
oracle agile_engineering_data_management 6.2.1.0
oracle agile_product_lifecycle_management 9.3.3
oracle agile_product_lifecycle_management 9.3.5
oracle agile_product_lifecycle_management 9.3.6
oracle communications_element_manager 8.1.1
oracle communications_element_manager 8.2.0
oracle communications_element_manager 8.2.1
oracle communications_instant_messaging_server 10.0.1.4.0
oracle health_sciences_empirica_inspections 1.0.1.2
oracle health_sciences_empirica_signal 7.3.3
oracle hospitality_guest_access 4.2.0
oracle hospitality_guest_access 4.2.1
Showing 30 of 38 entries

References & Advisories (52)

Showing 25 of 52 references

Bug Bounty Relevance

0 / 100
✓ Known exploited (KEV)

CVSS Score

Unscored

EPSS — Exploitation Probability

No EPSS data available

Intelligence Sources

kev ref →

External Links