Detections
Analytics
CVE-2020-1938
critical
Description
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
From the Tenable Blog
CVE-2020-1938: Ghostcat - Apache Tomcat AJP File Read/Inclusion Vulnerability (CNVD-2020-10487)
Published: 2020-02-22
Several proof-of-concept exploit scripts for recently patched flaw in Apache Tomcat are now available.
References
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.debian.org/security/2020/dsa-4680
https://www.debian.org/security/2020/dsa-4673
https://security.netapp.com/advisory/ntap-20200226-0002/
https://security.gentoo.org/glsa/202003-43
https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html
https://lists.debian.org/debian-lts-announce/2020/03/msg00006.html
http://support.blackberry.com/kb/articleDetail?articleNumber=000062739
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html
https://github.com/mukidulislamzihad/m2-vulnerability-assessment
https://github.com/chengbochuan3/CVE-Apache-Ecosystem
https://github.com/james-gasp/home-lab-vulnerability-scanner
https://github.com/Athology0000/cve-lab
https://github.com/sudichai/cve-destroyer
https://github.com/korneevscp/osint-target
https://github.com/e-fin/Nessus-CVE-POC-Finder
https://github.com/kamatmansi/OpenVAS
https://github.com/kamatmansi/Advanced-Web-Vulnerability-Scanner-OpenVAS
https://github.com/SallyAboud/Vulnerability-Scanner
https://github.com/daecayde/bloodhoundr
https://github.com/dinesh3690/Vulnerability-Assessment-Lab
https://github.com/krish-achanta/vuln-validator
https://github.com/daecayde/nightcrawler
https://github.com/flags-alt/abyss-c2
https://github.com/cyberguardsec101-sketch/ghostcat
https://github.com/baranii2105/nmap-recon-project
https://github.com/si1ence90/Ghostcat-Tomcat-AJP-Exploit-Py3
https://github.com/abhay-cyber4/vulnerable-lab-nessus
https://github.com/aidilzlkfli/Scanning
https://github.com/DiegoRodriguez-GL/bigschool-ciberseguridad
https://github.com/anjaniparikh0715/openvas-vulnerability-assessment-
https://github.com/Alam686/openvas-vulnerability-assessment
https://github.com/With-fate/CVE-2020-1938
https://github.com/phantom-offensive/AppAssault
https://github.com/phantom-offensive/AppAssaultLab
https://github.com/Phantom-C2-77/AppAssaultLab
https://github.com/AbdulMoiz6692/cve-vulnerability-scanner-pro
https://github.com/Andyyyyuan/CVE-Poc
https://github.com/RehmanAjaz/CVE-Scanner
https://github.com/Zahid-secure/cve-walkthrough-labs
https://github.com/CVE-ORG/CVE-ORG
https://github.com/abrewer251/CVE-2020-1938_Ghostcat-PoC
https://github.com/davide-capra/PrimoEsercizioCveSysSec
https://github.com/Joshua8821/CNVD
https://github.com/uttambodara/Awesome-Hacking-Learning-Path
https://github.com/wonderl-world1/Tomcat-cve-docker-environment
https://github.com/Yamewrong/cve-lab
https://github.com/erickrr-bd/Apache-Tomcat-Ghostcat-Vulnerability
https://github.com/hopsypopsy8/CVE-2020-1938-Exploitation
https://github.com/s1mpl3c0d3/cvepoc
https://github.com/ucsb-seclab/CVEX-records
https://github.com/ucsb-seclab/CVEX
https://github.com/lizhianyuguangming/TomcatWeakPassChecker
https://github.com/lizhianyuguangming/TomcatScanPro
https://github.com/Warelock/cve-2020-1938
https://github.com/0xget/cve-2001-1473
https://github.com/kuckibf/Popular-CVEs
https://github.com/Oracle-Security/Weaponized-CVEs
https://github.com/tpt11fb/AttackTomcat
https://github.com/jptr218/ghostcat
https://github.com/Neko2sh1ro/CVE-2020-1938
https://github.com/Neko-chanQwQ/CVE-2020-1938
https://github.com/MateoSec/ghostcatch
https://github.com/advisories/GHSA-c9hw-wf7x-jp9j
https://github.com/Umesh2807/Ghostcat
https://github.com/I-Runtime-Error/CVE-2020-1938
https://github.com/zhzyker/exphub
https://github.com/doggycheng/CNVD-2020-10487
https://github.com/w4fz5uck5/CVE-2020-1938-Clean-Version
https://github.com/Zaziki1337/Ghostcat-CVE-2020-1938
https://github.com/shaunmclernon/ghostcat-verification
https://github.com/b1cat/CVE_2020_1938_ajp_poc
https://github.com/00theway/Ghostcat-CNVD-2020-10487
https://github.com/delsadan/CNVD-2020-10487-Bulk-verification
https://github.com/ze0r/GhostCat-LFI-exp
https://github.com/laolisafe/CVE-2020-1938
https://github.com/sgdream/CVE-2020-1938
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1938
Details
Published: 2020-02-24
Updated: 2026-08-25
Named Vulnerability: GhostcatKnown Exploited Vulnerability (KEV)
Risk Information
CVSS v2
Base Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Severity: High
CVSS v3
Base Score: 9.8
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: Critical
EPSS
EPSS: 0.9927