WaratekVRT Sign in

CVE-2020-1938 Apache Tomcat

Affected softwareApache Tomcat
Severity9.8 Critical CVSS 3.1 3 scores
Fixed in9.0.31, 8.5.51, 7.0.100
WeaknessImproper privilege management (CWE-269)
Published24 Feb 2020
Updated13 Nov 2026

Description

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2022-03-03 · remediation due 2022-03-17 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 9 citations · honeypot sightings · 36 exploits · earliest 2020-04-15.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 42 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Nuclei; first seen 2020-02-20.
  • EPSS 99% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2020-1938 in VulnCheck (free account), which lists 4 more citations and 31 more exploit references not shown here.

EvidenceSourceDetailDate
Honeypot sighting VulnCheck canaries Exploitation attempts seen on 18 days 2025-10-17 to 2026-10-26
Reported exploitation teamt5.org /tw/posts/technical-analysis-on-backdoor-bifrost-of-the-Chinese-apt-group-huapi 2020-04-15
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2022-03-03
Reported exploitation securin.io /wp-content/uploads/2023/08/2023-State-of-Cybersecurity-for-Medical-Devices-and-Healthcare-Systems.pdf 2023-08-08
Reported exploitation thedfirreport.com /2023/12/18/lets-opendir-some-presents-an-analysis-of-a-persistent-actors-activity 2023-12-18
Reported exploitation cloudsek.com /blog/operation-escaneo-mexican-government-financial-institutions-cyberattack 2026-06-17
Exploit reference VulnCheck XDB 8d0f432c9695 Exploit type: info-leak 2020-02-20
Exploit reference VulnCheck XDB b2fb8d964e13 Exploit type: infoleak 2020-02-20
Exploit reference VulnCheck XDB 4218891c478f Exploit type: info-leak 2020-02-21
Exploit reference VulnCheck XDB a817195e5d04 Exploit type: info-leak 2020-02-21
Exploit reference VulnCheck XDB bfdfc9be53fb Exploit type: initial-access 2020-02-21
IndexArtifactStarsFirst seen
GitHub PoC Ghostcat read file/code execute,CNVD-2020-10487(CVE-2020-1938) 423 2020-02-22
Nuclei Ghostcat - Apache Tomcat - AJP File Read/Inclusion Vulnerability
Exploit-DB Apache Tomcat - AJP 'Ghostcat' File Read/Inclusion (Metasploit) 2020-11-13
GitHub PoC tomcat自动化漏洞扫描利用工具，支持批量弱口令检测、后台部署war包getshell、CVE-2017-12615 文件上传、CVE-2020-1938/CNVD-2020-10487 文件包含 300 2024-08-29
Exploit-DB Apache Tomcat - AJP 'Ghostcat File Read/Inclusion 2020-02-20
GitHub PoC Cnvd-2020-10487 / cve-2020-1938, scanner tool 294 2020-02-20
GitHub PoC Tomcat常见漏洞GUI利用工具。CVE-2017-12615 PUT文件上传漏洞、tomcat-pass-getshell 弱认证部署war包、弱口令爆破、CVE-2020-1938 Tomcat AJP文件读取/包含 259 2022-11-13
GitHub PoC Tomcat的文件包含及文件读取漏洞利用POC 57 2020-02-21
GitHub PoC xindongzhuaizhuai/CVE-2020-1938 45 2020-02-20
GitHub PoC CVE-2020-1938漏洞复现 38 2020-02-21

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR Process rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: ARMR Process rule

Process rule will blocks RCE, but we are unable to limit the rule scope to tainted payloads, as in this case payload is not HTTP tainted.

Only exploitable when the AJP connector (default port 8009) is reachable to untrusted clients; disable AJP or bind it to localhost if not required.

Attack is done over AJP (port 8009), not HTTP, where crafted Forward Request packets set javax.servlet.include.request_uri leading to arbitrary file reads or force JSP processing.

How to mitigate CVE-2020-1938

Upgrade Apache Tomcat to a release that fixes it: 9.0.31, 8.5.51 or 7.0.100. Until you can, Waratek RASP blocks exploitation with its process rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2025 ↗ CPU 2025-Q2 Oracle Autonomous Health Framework / Trace File Analyzer (Apache Tomcat) (23.8.0-23.11.0, 24.1.0-24.11.0, 25.1.0, 25.2.0)
Oracle Critical Patch Update October 2020 ↗ CPU 2020-Q4 Oracle Supply Chain / Folders, Files & Attachments (Apache Tomcat) (9.3.3, 9.3.5, 9.3.6)
Oracle Critical Patch Update July 2020 ↗ CPU 2020-Q3 Oracle Communications Applications / Core (Apache Tomcat) (8.1.1, 8.2.0, 8.2.1)
Oracle Communications Applications / Installation (Apache Tomcat) (10.0.1.4.0)
Oracle Health Sciences Applications / Web server (Apache Tomcat) (1.0.1.2)
Oracle Health Sciences Applications / Web server (Apache Tomcat) (7.3.3)
Oracle Hospitality Applications / Base (Apache Tomcat) (4.2.0, 4.2.1)
Oracle MySQL / Monitoring: General (Apache Tomcat) (4.0.12 and prior, 8.0.20 and prior)
Oracle Siebel CRM / EAI, SWSE (Apache Tomcat) (20.5 and prior)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Autonomous Health Framework Trace File Analyzer (Apache Tomcat) 23.8.0-23.11.0, 24.1.0-24.11.0, 25.1.0, 25.2.0 25.1.0 · 25.2.0
Oracle Communications Applications Core (Apache Tomcat) 8.1.1, 8.2.0, 8.2.1 8.1.1 · 8.2.0 · 8.2.1
Oracle Communications Applications Installation (Apache Tomcat) 10.0.1.4.0 10.0.1.4.0
Oracle Health Sciences Applications Web server (Apache Tomcat) 1.0.1.2 1.0.1.2 · 7.3.3
Oracle Hospitality Applications Base (Apache Tomcat) 4.2.0, 4.2.1 4.2.0 · 4.2.1
Oracle MySQL Monitoring: General (Apache Tomcat) 4.0.12 and prior, 8.0.20 and prior
Oracle Siebel CRM EAI, SWSE (Apache Tomcat) 20.5 and prior
Oracle Supply Chain Folders, Files & Attachments (Apache Tomcat) 9.3.3, 9.3.5, 9.3.6 9.3.3 · 9.3.5 · 9.3.6

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.apache.tomcat.embed:tomcat-embed-core 9.0.0 9.0.31 unbounded
org.apache.tomcat.embed:tomcat-embed-core 8.0.0 8.5.51 unbounded
org.apache.tomcat.embed:tomcat-embed-core 7.0.0 7.0.100 unbounded

Products and versions

22 products, 41 version entries
SourceVendorProductSchemeAffected versions
nvd apache geode generic 1.12.0
nvd apache tomcat generic ≥ 7.0.0 and ＜ 7.0.100 · ≥ 8.5.0 and ＜ 8.5.51 · ≥ 9.0.0 and ＜ 9.0.31
nvd blackberry good control generic ≤ 5.2.58.38
nvd blackberry workspaces server generic 7.0.1 · 7.1.2 · 8.1.0 · 9.0
nvd debian debian linux generic 8.0 · 9.0 · 10.0
nvd fedoraproject fedora generic 30 · 31 · 32
nvd netapp data availability services generic any version
nvd netapp oncommand system manager generic ≥ 3.0.0 and ≤ 3.1.3
nvd opensuse leap generic 15.1
nvd oracle agile engineering data management generic 6.2.1.0
nvd oracle agile product lifecycle management generic 9.3.3 · 9.3.5 · 9.3.6
nvd oracle communications element manager generic 8.1.1 · 8.2.0 · 8.2.1
nvd oracle communications instant messaging server generic 10.0.1.4.0
nvd oracle health sciences empirica inspections generic 1.0.1.2
nvd oracle health sciences empirica signal generic 7.3.3
nvd oracle hospitality guest access generic 4.2.0 · 4.2.1
nvd oracle instantis enterprisetrack generic ≥ 17.1 and ≤ 17.3
nvd oracle mysql enterprise monitor generic ≤ 4.0.12 · ≥ 8.0.0 and ≤ 8.0.20
nvd oracle siebel ui framework generic ≤ 20.5
nvd oracle transportation management generic 6.3.7
nvd oracle workload manager generic 12.2.0.1 · 18c · 19c
osv org.apache.tomcat.embed tomcat-embed-core generic ≥ 7.0.0 and ＜ 7.0.100 · ≥ 8.0.0 and ＜ 8.5.51 · ≥ 9.0.0 and ＜ 9.0.31

References

URLTags
https://lists.apache.org/thread.html/re5eecbe5bf967439bafeeaa85987b3a43f0e6efe06b6976ee768cde2@%3Cusers.tomcat.apache.org%3E WEB
https://lists.apache.org/thread.html/re5eecbe5bf967439bafeeaa85987b3a43f0e6efe06b6976ee768cde2%40%3Cusers.tomcat.apache.org%3E WEB
https://lists.apache.org/thread.html/rd50baccd1bbb96c2327d5a8caa25a49692b3d68d96915bd1cfbb9f8b@%3Cusers.tomcat.apache.org%3E WEB
https://lists.apache.org/thread.html/rd50baccd1bbb96c2327d5a8caa25a49692b3d68d96915bd1cfbb9f8b%40%3Cusers.tomcat.apache.org%3E WEB
https://lists.apache.org/thread.html/rd0774c95699d5aeb5e16e9a600fb2ea296e81175e30a62094e27e3e7@%3Ccommits.ofbiz.apache.org%3E WEB
https://lists.apache.org/thread.html/rd0774c95699d5aeb5e16e9a600fb2ea296e81175e30a62094e27e3e7%40%3Ccommits.ofbiz.apache.org%3E WEB
https://lists.apache.org/thread.html/rce2af55f6e144ffcdc025f997eddceb315dfbc0b230e3d750a7f7425@%3Cnotifications.ofbiz.apache.org%3E WEB
https://lists.apache.org/thread.html/rce2af55f6e144ffcdc025f997eddceb315dfbc0b230e3d750a7f7425%40%3Cnotifications.ofbiz.apache.org%3E WEB
https://lists.apache.org/thread.html/rcd5cd301e9e7e39f939baf2f5d58704750be07a5e2d3393e40ca7194@%3Ccommits.tomee.apache.org%3E WEB
https://lists.apache.org/thread.html/rcd5cd301e9e7e39f939baf2f5d58704750be07a5e2d3393e40ca7194%40%3Ccommits.tomee.apache.org%3E WEB

Timeline
Published2020-02-24By the CVE Program.
VulnCheck KEV: earliest evidence2020-04-15Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2022-03-03Listed in CISA's Known Exploited Vulnerabilities catalog.
NVD record modified2026-08-25NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-11-10Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.