CVE-2018-11759— Apache Tomcat JK (mod_jk) Connector 路径遍历漏洞
Public Exploits 1
Nuclei · 1 CVE-2018-11759.yaml [template]
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2018-11759の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
N/A
ソース: CVE Program / CVE List V5
脆弱性説明
The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical.
ソース: CVE Program / CVE List V5
CVSS情報
N/A
ソース: CVE Program / CVE List V5
脆弱性タイプ
N/A
ソース: CVE Program / CVE List V5
脆弱性タイトル
Apache Tomcat JK (mod_jk) Connector 路径遍历漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Apache Tomcat JK（mod_jk）Connector是美国阿帕奇（Apache）软件基金会的一款为Apache或IIS提供连接后台Tomcat的模块，它支持集群和负载均衡等。 Apache Tomcat JK（mod_jk）Connector 1.2.0版本至1.2.44版本中存在目录遍历漏洞。攻击者可利用该漏洞造成信息泄露。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| Apache Software Foundation | Apache Tomcat Connectors | Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 | - |
II. CVE-2018-11759の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|---|---|---|
| 1 | Proof of concept showing how to exploit the CVE-2018-11759 | https://github.com/immunIT/CVE-2018-11759 | POC詳細 |
| 2 | This exploit for CVE 2018-11759, vulnerability in apache mod_jk, module for load-balancer | https://github.com/Jul10l1r4/Identificador-CVE-2018-11759 | POC詳細 |
| 3 | None | https://github.com/julioliraup/Identificador-CVE-2018-11759 | POC詳細 |
| 4 | Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 allows specially constructed requests to expose application functionality through the reverse proxy. It is also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11759.yaml | POC詳細 |
| 5 | None | https://github.com/Threekiii/Awesome-POC/blob/master/%E4%B8%AD%E9%97%B4%E4%BB%B6%E6%BC%8F%E6%B4%9E/Apache%20Mod_jk%20%E8%AE%BF%E9%97%AE%E6%8E%A7%E5%88%B6%E6%9D%83%E9%99%90%E7%BB%95%E8%BF%87%20CVE-2018-11759.md | POC詳細 |
| 6 | None | https://github.com/chaitin/xray-plugins/blob/main/poc/manual/tomcat-cve-2018-11759.yml | POC詳細 |
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2018-11759のインテリジェンス情報
请登录查看更多情报信息。
CVE-2018-11759 厂商安全公告 (5)
- https://www.oracle.com/security-alerts/cpujan2020.htmlx_refsource_MISC
CVE-2018-11759 邮件列表归档 (7)
IV. 関連脆弱性
同じベンダー: Apache Software Foundation
- CVE-2026-73632
Apache Struts: Shared serialization state in the JSON plugin - CVE-2026-73631
Apache Struts: Shared parsing state in the JSON plugin - CVE-2026-73635
Apache Struts: Unbounded growth of localized-text caches dri - CVE-2026-73634
Apache Struts: Unbounded read of a Content Security Policy v - CVE-2026-73633
Apache Struts: Unbounded read of a JSON request body
V. CVE-2018-11759へのコメント
まだコメントはありません