dbcve.org
Actively exploited in the wild. This CVE is on the CISA Known Exploited Vulnerabilities list — treat remediation as urgent. Federal remediation due by 17 Mar 2022.
GeodeApplication · Apache

CVE-2020-1938

CRITICAL · 9.8 CVSS v3.1 Published 2020-02-24
Fix available
A fix is available. Upgrade to 7.0.100 / 8.5.51 or later.
See remediation →
100/100
Remediation priority · Urgent
In the wild High EPSS Public exploit Remotely reachable No privileges Zero-click Patch available

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Ghostcat is a critical vulnerability in Apache Tomcat's AJP (Apache JServ Protocol) connector. When the AJP port is accessible to untrusted users, an attacker can read arbitrary files from anywhere in the web application and process any file as a JSP, enabling remote code execution if file upload functionality exists.

MitigationUpgrade to Tomcat 9.0.31+/8.5.51+/7.0.100+ OR disable the AJP connector if not required AND ensure the AJP port is not exposed to untrusted networks.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
GeodeApplication
Affected:= 1.12.0
TomcatWeb server / proxy
Affected:>= 7.0.0, < 7.0.100>= 8.5.0, < 8.5.51>= 9.0.0, < 9.0.31
FedoraOperating system
Affected:= 30= 31= 32
Debian LinuxOperating system
Affected:= 8.0= 9.0= 10.0
Agile Engineering Data ManagementApplication
Affected:= 6.2.1.0
Agile PlmApplication
Affected:= 9.3.3= 9.3.5= 9.3.6
Communications Element ManagerApplication
Affected:= 8.1.1= 8.2.0= 8.2.1
Communications Instant Messaging ServerApplication
Affected:= 10.0.1.4.0

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify Tomcat version
    Run 'catalina.sh version' or check the filename in the Tomcat installation directory (e.g., bin/catalina.jar version) to get the exact version number
    Affected if Version is 7.0.0 to 7.0.99, 8.5.0 to 8.5.50, or 9.0.0 to 9.0.30
  2. Locate server.xml configuration
    Find the server.xml file, typically in the conf/ directory of the Tomcat installation
    Affected if server.xml exists and contains AJP connector configuration
  3. Verify AJP connector is enabled
    Search server.xml for an <Connector> element with protocol="AJP" or port 8009 (the default AJP port)
    Affected if An active AJP connector element is present in the configuration
  4. Check AJP connector binding
    In server.xml, locate the 'address' attribute of the AJP connector. If absent, it defaults to all interfaces (0.0.0.0)
    Affected if The address attribute is missing or set to 0.0.0.0 or an externally accessible IP
  5. Confirm AJP secret is not set
    In server.xml, check the AJP connector for the 'secret' attribute. If absent or not configured, the default no-secret value is accepted
    Affected if The 'secret' attribute is missing or not set to a strong value

The system is affected if Tomcat version falls within the vulnerable range AND the AJP connector is enabled and accessible to untrusted network paths without a configured secret.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 7.0.100 / 8.5.51 / 9.0.31 or later
Fixed in 7.0.1008.5.519.0.31
Vendor patch lists.apache.org →
Interim mitigation

Upgrade to Tomcat 9.0.31+/8.5.51+/7.0.100+ OR disable the AJP connector if not required AND ensure the AJP port is not exposed to untrusted networks.

Recommended fix High confidence

Tomcat 9.0.31+ (for 9.x), 8.5.51+ (for 8.5.x), or 7.0.100+ (for 7.x) - also applies to products bundled with these Tomcat versions such as Geode 1.12.0

  1. Identify all Tomcat instances running affected versions (7.0.0-7.0.99, 8.5.0-8.5.50, 9.0.0-9.0.30) in the environment
  2. Determine if the AJP connector is required for your application (e.g., used with mod_jk, mod_proxy_ajp, or Kubernetes ingress)
  3. If AJP connector is not required: disable it in server.xml by commenting out or removing the AJP <Connector> element, or block the AJP port (default 8009) at the network/firewall level from untrusted sources
  4. If AJP connector is required: upgrade to Tomcat 9.0.31 or later (for 9.x), 8.5.51 or later (for 8.5.x), or 7.0.100 or later (for 7.x)
  5. After upgrading, review the AJP connector configuration in server.xml and adjust settings to match the hardened defaults introduced in the fixed versions (e.g., secretRequired=true, secret attribute if using authentication)
  6. Test the configuration in a non-production environment before deploying to production
  7. Verify the fix by confirming the Tomcat version and testing that the AJP port responds only with expected behavior
Caveat Minor: Upgrading to the fixed version may require small configuration changes to the AJP connector due to hardened default settings (e.g., secretRequired attribute, new default values)

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Geode Exploited in the wild — priority engagement
  • Consultation4.0 h
  • Implementation6.0 h
  • Testing4.0 h
  • Review / QA2.0 h
16.0 hours of engineering $2,840
Get it fixed fast

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,544.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2020-1938 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2020-1938 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data