Apache Tomcat Jk Connector vulnerabilities

3 CVEs affecting Apache Tomcat Jk Connector, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-11759, published 2018-10-31.

More from Apache.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-11759, published 2018-10-31. High severity, CVSS 7.5. EPSS: 90.6% chance of exploitation in the next 30 days. The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge…
• CVE-2018-1323, published 2018-03-12. High severity, CVSS 7.5. EPSS: 46.4% chance of exploitation in the next 30 days. The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map did not handle some edge cases…
• CVE-2016-6808, published 2017-04-12. Critical severity, CVSS 9.8. EPSS: 22.7% chance of exploitation in the next 30 days. Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42.