CyberSecBulletin
CVE-2020-1938Exploited in the wildNVD status: Analyzed

Apache Tomcat Improper Privilege Management

Published Updated By the CyberSecBulletin desk

CVE-2020-1938 is a critical-severity vulnerability in Apache Tomcat from Apache, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected Apache Tomcat versions: Apache Tomcat 9.0.0.M1 to 9.0.0.30; 8.5.0 to 8.5.50; 7.0.0 to 7.0.99. The record does not name a fixed version, so check the vendor advisory. CISA added it to the Known Exploited Vulnerabilities catalogue on March 3, 2022, which means attacks have been observed in the wild.

Patch now

Attackers are already exploiting this vulnerability, according to CISA.

What to do

  1. Update Tomcat to 7.0.100 or 8.5.51 or 9.0.31, whichever matches your release line, or a later version.
  2. CISA's required action: Apply updates per vendor instructions.
  3. Read the advisory on lists.apache.org for workarounds and exact fixed builds.
  4. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
ApacheApache TomcatApache Tomcat 9.0.0.M1 to 9.0.0.30; 8.5.0 to 8.5.50; 7.0.0 to 7.0.99Not stated
ApacheGeode1.12.0Not stated
ApacheTomcat7.0.0 up to, but not including, 7.0.100; 8.5.0 up to, but not including, 8.5.51; 9.0.0 up to, but not including, 9.0.317.0.100, 8.5.51, 9.0.31
Fedora ProjectFedora30; 31; 32Not stated
OracleAgile Engineering Data Management6.2.1.0Not stated
OracleAgile Product Lifecycle Management9.3.3; 9.3.5; 9.3.6Not stated
OracleCommunications Element Manager8.1.1; 8.2.0; 8.2.1Not stated
OracleCommunications Instant Messaging Server10.0.1.4.0Not stated
OracleHealth Sciences Empirica Inspections1.0.1.2Not stated
OracleHealth Sciences Empirica Signal7.3.3Not stated
OracleHospitality Guest Access4.2.0; 4.2.1Not stated
OracleInstantis Enterprisetrack17.1 through 17.3Not stated
OracleMySQL Enterprise Monitor4.0.12 and earlier; 8.0.0 through 8.0.20Not stated
OracleSiebel UI Framework20.5 and earlierNot stated
OracleTransportation Management6.3.7Not stated
OracleWorkload Manager12.2.0.1; 18c; 19cNot stated
DebianDebian Linux8.0; 9.0; 10.0Not stated
openSUSELeap15.1Not stated
BlackberryGood Control5.2.58.38 and earlierNot stated
BlackberryWorkspaces Server7.0.1; 7.1.2; 8.1.0; 9.0Not stated
NetAppData Availability ServicesNot specified in the recordNot stated
NetAppOncommand System Manager3.0.0 through 3.1.3Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.19.8CriticalNVD
CVSS 3.19.8CriticalCISA (ADP)
CVSS 2.07.5HighNVD

Official description

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

Timeline

  1. CVE record published.
  2. Added to CISA's Known Exploited Vulnerabilities catalogue.
  3. Deadline for US federal agencies to remediate, set by CISA.
  4. CISA published its SSVC assessment (exploitation: active, automatable: yes, technical impact: total).
  5. Record last changed materially (score, affected products, status or references).

References

Patches and release notes

Other references

Other vulnerabilities in Apache Tomcat

All Apache Tomcat vulnerabilities

Spotted an error? Tell us.