CVE-2020-1938

Apache Tomcat is like the front door and hallway system for your web apps. This bug is specifically about a side-door called AJP: Tomcat treats calls made through AJP as “more trustworthy” than normal web traffic. If someone outside your business can reach that side-door, they may be able to pull up files they shouldn’t see and, in some setups, turn uploaded or controllable files into a way to run commands on the server.

This matters to you if you use or run Apache Tomcat with the AJP Connector enabled by default in versions such as Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50, or 7.0.0 to 7.0.99, or if you expose the AJP port to untrusted users. It also matters if you operate systems that ship these affected Tomcat versions, including Debian GNU/Linux communities and distributions like Astra Linux Special Edition, OpenSUSE Leap, and Fedora, plus the listed Oracle products that include Tomcat (e.g., Agile Engineering Data Management, Oracle Hospitality Guest Access, Oracle Communications Element Manager, Oracle Agile PLM).

This is RED because it’s critical and is listed as known exploited in the wild, with a public exploit available and a very high estimated chance of exploitation soon. If your Tomcat’s AJP port can be reached by someone outside your control (like the public internet, or a less-trusted network), you should treat it as urgent to close the gap today.

Step 1: Identify your exposure

• Determine whether you are running one of the affected Apache Tomcat versions: 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50, or 7.0.0 to 7.0.99.
• Check your Tomcat configuration to see whether the AJP Connector is enabled.
• Verify where it listens: the report notes affected builds shipped with an AJP Connector that listened on all configured IP addresses when enabled by default.
• Determine whether the AJP port is reachable from “untrusted users” (for example, the public internet, partner networks, or any network segment you don’t fully control).

Step 2: Patch as the primary fix

• Upgrade Apache Tomcat to one of: 9.0.31, 8.5.51, or 7.0.100 or later.
• After upgrading, review the AJP Connector settings, since Tomcat made changes to the default AJP Connector configuration in 9.0.31 (hardening the defaults) and you may need small configuration changes after the upgrade.

Step 3: Harden if you cannot fully upgrade immediately

• If the AJP port is accessible to untrusted users, you must act—either:
  • Disable the AJP Connector if you do not require AJP for your setup, or
  • Restrict it so it is only reachable from trusted systems (for example, only from the reverse proxy/load balancer that needs it).
• Ensure network controls (firewall rules/security groups) block AJP access from untrusted sources.

Step 4: Consider defense-in-depth for the “file read / JSP execution” path

• The report states mitigation is only required if an AJP port is accessible to untrusted users, but for defense-in-depth you can also:
  • Prevent scenarios where an attacker can place or influence files that end up inside the web application.
  • Restrict file upload capabilities and ensure uploaded content is stored outside the web application directory when possible.

Step 5: Monitor and confirm

• After changes, confirm that:
  • AJP is disabled or only listening on the expected trusted interfaces.
  • External networks cannot reach the AJP port.
  • Your Tomcat version is actually the upgraded version.
• If you have logs, review web/proxy and Tomcat logs for unusual AJP-related requests or error patterns around the time of any suspicious activity.

Step 6: For packaged distributions and integrated products

• For Debian GNU/Linux community builds, Astra Linux Special Edition, OpenSUSE Leap, Fedora, and the listed Oracle products that include Tomcat: follow your vendor’s security updates for the bundled Apache Tomcat version, then re-verify the AJP Connector exposure/behavior in your installed configuration.

Severity and why it’s serious: CVE-2020-1938 is rated 9.8 (CRITICAL) and is marked as known exploited in the wild (CISA KEV). EPSS is 99.3% estimated probability of exploitation in the next 30 days, and public exploit availability plus a detection template (Nuclei) indicate attackers can find and use vulnerable targets quickly.

What the weakness is: In affected Apache Tomcat versions (9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50, and 7.0.0 to 7.0.99), the AJP Connector was shipped enabled by default and could listen on all configured IP addresses. Tomcat treats AJP connections as higher trust than normal HTTP connections.

Attack impact described: If an attacker can reach the AJP port, the report identifies a mechanism that can (1) return arbitrary files from anywhere in the web application and (2) process any file in the web application as a JSP. If file upload exists and the uploaded files are stored within the web application (or the attacker can otherwise influence web app files), then the JSP processing capability can enable remote code execution.

Attack vector: Network-reachable AJP Connector. Exploitation requires AJP port accessibility to untrusted users.

Mitigation guidance from the report: Upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later, and note that some small configuration adjustments may be needed. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden defaults.

Exploitation status nuance: The provided description says exploitation status (from press) indicates none, but the CVE is still listed as known exploited in the wild (CISA KEV) and has a public exploit available—so real-world attacker activity is already indicated by the KEV status.

About EPSS/KEV: EPSS estimates how likely exploitation is in a near-term window; KEV means it’s been confirmed as exploited in the wild by CISA. These are indicators of risk and urgency, not proof that every single installation is currently compromised.