CVE-2007-1860

Currently unrated

Key Information:

Vendor
Apache
Status
Tomcat Jk Web Server Connector
Vendor
CVE Published:
25 May 2007

Summary

mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.

References

http://www.debian.org/security/2007/dsa-1312
vendor-advisoryx_refsource_DEBIAN
http://www.vupen.com/english/advisories/2007/2732
vdb-entryx_refsource_VUPEN
https://oval.cisecurity.org/repository/search/definition/...
vdb-entrysignaturex_refsource_OVAL

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.