GCVE - cpe:2.3:a:apache:tomcat_jk_connector:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:tomcat_jk_connector:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Tomcat Jk Connector (`73070367-48bd-5b03-9af4-50ad2674a75a`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:apache/tomcat`	purl2cpe	2026-06-01 10:14:31.281112

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2018-1323`	vulnerable	2026-06-08 05:11:17.705046	Details available The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via IIS, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing Tomcat via the reverse proxy. Published: 2018-03-12T16:00:00.000Z Updated: 2024-09-17T02:16:54.351Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/103389 https://access.redhat.com/errata/RHSA-2018:1843 https://lists.apache.org/thread.html/6e146bce83578bd870893250ba8354e28f9d8e86c674c30dbeee529f%40%3Cannounce.tomcat.apache.org%3E https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3E	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-11759`	vulnerable	2026-06-08 05:10:38.911251	Details available The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical. Published: 2018-10-31T20:00:00.000Z Updated: 2024-08-05T08:17:08.977Z Open on db.gcve.eu Reference links https://www.debian.org/security/2018/dsa-4357 https://access.redhat.com/errata/RHSA-2019:0367 http://www.securityfocus.com/bid/105888 https://lists.apache.org/thread.html/6d564bb0ab73d6b3efdd1d6b1c075d1a2c84ecd84a4159d6122529ad%40%3Cannounce.tomcat.apache.org%3E https://lists.debian.org/debian-lts-announce/2018/12/msg00007.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-6808`	vulnerable	2026-06-08 05:08:11.017043	Details available Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42. Published: 2017-04-12T20:00:00.000Z Updated: 2024-08-06T01:43:37.913Z Open on db.gcve.eu Reference links http://www.securitytracker.com/id/1036969 http://seclists.org/fulldisclosure/2016/Oct/44 https://access.redhat.com/errata/RHSA-2017:0194 http://www.securityfocus.com/bid/93429 https://access.redhat.com/errata/RHSA-2017:0193	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.