Information Disclosure in Apache Tomcat's JK Connector by the Apache Software Foundation

CVE-2008-5519

Summary

The Apache Tomcat JK Connector (mod_jk) versions 1.2.0 through 1.2.26 enables remote attackers to gain unauthorized access to sensitive information. This occurs under certain opportunistic conditions, such as when an HTTP request from a different client includes a Content-Length header without accompanying POST data. Additionally, rapid successive requests that do not adhere to the AJP protocol’s standards for handling requests with Content-Length headers can also trigger this vulnerability. The lack of strict compliance opens pathways for potential information leaks.

References