Which products and versions are affected by CVE-2020-1938?

Affected: Geode (Apache) versions 1.12.0; Tomcat (Apache) versions >= 7.0.0; Good Control (Blackberry), among others. The full list is in the CVE brief.

Is CVE-2020-1938 being exploited in the wild?

It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Apr 15, 2020.

Is CVE-2020-1938 in the CISA KEV catalog?

Yes. It was added on Mar 3, 2022 with a federal remediation due date of Mar 17, 2022.

Is there a public exploit for CVE-2020-1938?

Public exploit code is available.

Is there a fix for CVE-2020-1938?

Fixed versions are available, including Tomcat 7.0.100, Tomcat 8.5.51, Tomcat 9.0.31.

How urgently should CVE-2020-1938 be patched?

Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Request A Demo

Vulnerability Intelligence

CVE-2020-1938

CriticalExploitedPublic exploit

Improper Privilege Management in Tomcat

Published Jun 15, 2020 · Updated Sep 8, 2026 · Also known as BIT-tomcat-2020-1938, DEBIAN-CVE-2020-1938, GHSA-c9hw-wf7x-jp9j, Ghostcat, SUSE-SU-2020:0725-1, SUSE-SU-2020:0806-1, SUSE-SU-2020:14334-1, TR-21-1017, UBUNTU-CVE-2020-1938

Key Facts

Patch immediately

CVE-2020-1938 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Geode (Apache), Tomcat (Apache), Good Control (Blackberry) and 22 more products.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Apr 15, 2020. Public exploit code is available.
EPSS estimates a 99% probability of exploitation in the next 30 days.
Fixed versions are available, including Tomcat 7.0.100, Tomcat 8.5.51, Tomcat 9.0.31.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

99%

Higher than 99.9% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2020-1938 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

Known-Exploited Catalog Listings

Catalog	Added	Remediation due	Ransomware use
CISA KEV	Mar 3, 2022	Mar 17, 2022	Not reported
Industry KEV feed	Apr 15, 2020	Mar 17, 2022	Not reported
CIRCL KEV	Mar 3, 2022	Mar 17, 2022	Not reported
ENISA EUVD	Mar 3, 2022	n/a	Not reported

Required action: Apply updates per vendor instructions.

Affected Products

815 affected entries in total

Product	Affected versions	Fixed in
GeodeApache	1.12.0	n/a
TomcatApache	>= 7.0.0	7.0.100
Good ControlBlackberry	See advisory	5.2.58.38
Workspaces ServerBlackberry	7.0.1, 7.1.2, 8.1.0, 9.0	n/a
Data Availability ServicesNetapp	See advisory	n/a

20 more affected products in the full CVE brief

Patched Releases

Tomcat

7.0.100, 8.5.51, 9.0.31, 8.5.51-1.ph1, 8.5.51-1.ph2, 8.5.51-1.ph3, NA, 0:7.0.76-11.el7_7, 7.0.76-10.amzn2.0.1, 7.0.76-11.el7_7, 8.0.53-10.38.1, 8.0.53-29.22.1, 9.0.31-3.25.1, 9.0.31-3.42.2, 9.0.31-4.22.1, 9.0.31-lp151.3.12.1, 9.0.36-8.4

apache-commons-collections

3.2.2-10.module+el8.3.0+53+ea062990

apache-commons-lang

2.6-21.module+el8.3.0+53+ea062990

apache-commons-net

3.6-3.module+el8.3.0+53+ea062990

tomcat-webapps

NA, 7.0.76-10.amzn2.0.1, 7.0.76-11.el7_7, 8.0.53-10.38.1, 8.0.53-29.22.1, 9.0.31-3.25.1, 9.0.31-3.42.2, 9.0.31-4.22.1, 9.0.31-lp151.3.12.1, 9.0.36-8.4

apache2