CVE-2007-1860
NoneCVSS
—
EPSS
13.2%
Published
May 25, 2007
CISA due date
—
The record
mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | libapache-mod-jk | 0 | 1:1.2.23-1 |
| Debian:12 | libapache-mod-jk | 0 | 1:1.2.23-1 |
| Debian:13 | libapache-mod-jk | 0 | 1:1.2.23-1 |
| Debian:3.1 | libapache-mod-jk | 0 | 1:1.2.5-2sarge1 |
| Debian:4.0 | libapache-mod-jk | 0 | 1:1.2.18-3etch1 |
| Red Hat:network_satellite:4.2::el3 | jabberd | 0 | 0:2.0s10-3.37.rhn |
| Red Hat:network_satellite:4.2::el3 | java-1.4.2-ibm | 0 | 0:1.4.2.10-1jpp.2.el3 |
| Red Hat:network_satellite:4.2::el3 | java-1.4.2-ibm-devel | 0 | 0:1.4.2.10-1jpp.2.el3 |
| Red Hat:network_satellite:4.2::el3 | jfreechart | 0 | 0:0.9.20-3.rhn |
| Red Hat:network_satellite:4.2::el3 | openmotif21 | 0 | 0:2.1.30-9.RHEL3.8 |
| Red Hat:network_satellite:4.2::el3 | openmotif21-debuginfo | 0 | 0:2.1.30-9.RHEL3.8 |
| Red Hat:network_satellite:4.2::el3 | perl-Crypt-CBC | 0 | 0:2.24-1.el3 |
| Red Hat:network_satellite:4.2::el3 | rhn-apache | 0 | 0:1.3.27-36.rhn.rhel3 |
| Red Hat:network_satellite:4.2::el3 | rhn-modjk-ap13 | 0 | 0:1.2.23-2rhn.rhel3 |
| Red Hat:network_satellite:4.2::el3 | rhn-modperl | 0 | 0:1.29-16.rhel3 |
| Red Hat:network_satellite:4.2::el3 | rhn-modssl | 0 | 0:2.8.12-8.rhn.10.rhel3 |
| Red Hat:network_satellite:4.2::el3 | tomcat5 | 0 | 0:5.0.30-0jpp_10rh |
| Red Hat:network_satellite:4.2::el4 | jabberd | 0 | 0:2.0s10-3.38.rhn |
| Red Hat:network_satellite:4.2::el4 | java-1.4.2-ibm | 0 | 0:1.4.2.10-1jpp.2.el4 |
| Red Hat:network_satellite:4.2::el4 | java-1.4.2-ibm-devel | 0 | 0:1.4.2.10-1jpp.2.el4 |
| Red Hat:network_satellite:4.2::el4 | jfreechart | 0 | 0:0.9.20-3.rhn |
| Red Hat:network_satellite:4.2::el4 | openmotif21 | 0 | 0:2.1.30-11.RHEL4.6 |
| Red Hat:network_satellite:4.2::el4 | openmotif21-debuginfo | 0 | 0:2.1.30-11.RHEL4.6 |
| Red Hat:network_satellite:4.2::el4 | perl-Crypt-CBC | 0 | 0:2.24-1.el4 |
| Red Hat:network_satellite:4.2::el4 | rhn-apache | 0 | 0:1.3.27-36.rhn.rhel4 |
| Red Hat:network_satellite:4.2::el4 | rhn-modjk-ap13 | 0 | 0:1.2.23-2rhn.rhel4 |
| Red Hat:network_satellite:4.2::el4 | rhn-modperl | 0 | 0:1.29-16.rhel4 |
| Red Hat:network_satellite:4.2::el4 | rhn-modssl | 0 | 0:2.8.12-8.rhn.10.rhel4 |
| Red Hat:network_satellite:4.2::el4 | tomcat5 | 0 | 0:5.0.30-0jpp_10rh |
| Red Hat:network_satellite:5.0:el4 | jabberd | 0 | 0:2.0s10-3.38.rhn |
| Red Hat:network_satellite:5.0:el4 | java-1.4.2-ibm | 0 | 0:1.4.2.10-1jpp.2.el4 |
| Red Hat:network_satellite:5.0:el4 | java-1.4.2-ibm-devel | 0 | 0:1.4.2.10-1jpp.2.el4 |
| Red Hat:network_satellite:5.0:el4 | jfreechart | 0 | 0:0.9.20-3.rhn |
| Red Hat:network_satellite:5.0:el4 | openmotif21 | 0 | 0:2.1.30-11.RHEL4.6 |
| Red Hat:network_satellite:5.0:el4 | openmotif21-debuginfo | 0 | 0:2.1.30-11.RHEL4.6 |
| Red Hat:network_satellite:5.0:el4 | perl-Crypt-CBC | 0 | 0:2.24-1.el4 |
| Red Hat:network_satellite:5.0:el4 | rhn-apache | 0 | 0:1.3.27-36.rhn.rhel4 |
| Red Hat:network_satellite:5.0:el4 | rhn-modjk-ap13 | 0 | 0:1.2.23-2rhn.rhel4 |
| Red Hat:network_satellite:5.0:el4 | rhn-modperl | 0 | 0:1.29-16.rhel4 |
| Red Hat:network_satellite:5.0:el4 | rhn-modssl | 0 | 0:2.8.12-8.rhn.10.rhel4 |
| Red Hat:network_satellite:5.0:el4 | tomcat5 | 0 | 0:5.0.30-0jpp_10rh |
| Red Hat:rhel_application_server:2 | mod_jk | 0 | 0:1.2.20-1jpp_2rh |
| Red Hat:rhel_application_server:2 | mod_jk-ap20 | 0 | 0:1.2.20-1jpp_2rh |
| Red Hat:rhel_application_server:2 | mod_jk-debuginfo | 0 | 0:1.2.20-1jpp_2rh |
| Red Hat:rhel_application_server:2 | mod_jk-manual | 0 | 0:1.2.20-1jpp_2rh |
| Red Hat:rhel_application_stack:1 | mod_jk | 0 | 0:1.2.20-1.el4s1.5 |
| Red Hat:rhel_application_stack:1 | mod_jk-ap20 | 0 | 0:1.2.20-1.el4s1.5 |
| Red Hat:rhel_application_stack:1 | mod_jk-debuginfo | 0 | 0:1.2.20-1.el4s1.5 |
| Red Hat:rhel_application_stack:1 | mod_jk-manual | 0 | 0:1.2.20-1.el4s1.5 |
Related vulnerabilities
- CVE-2024-46544 Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local… Also affects libapache-mod-jk
- CVE-2023-41081 Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat… Also affects libapache-mod-jk
- CVE-2018-11759 The Apache Web Server (httpd) specific code that normalised the requested path before… Also affects libapache-mod-jk
- CVE-2007-0774 Stack-based buffer overflow in the map_uri_to_worker function… Also affects libapache-mod-jk
- CVE-2008-0128 The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat… Also affects jabberd
- CVE-2007-6388 Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0… Also affects jabberd
- CVE-2007-5000 Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP… Also affects jabberd
- CVE-2007-5461 Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0… Also affects jabberd