Buffer Overflow

Apache Tomcat JK ISAPI Connector is vulnerable to buffer overflow attacks. A remote user can send a specifically crafted URI to the target virtual host to trigger a buffer overflow in the JK ISAPI connector and potentially execute arbitrary code on the target system which may leads the applicatio...

CVE-2018-1323

The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via IIS, then it was possible fo...

CVE-2018-1323

The issue (CVE-2018-1323) affects Apache Tomcat JK Connector (mod_jk) IIS/ISAPI integration: the ISAPI Connector 1.2.0–1.2.42 path normalization in jk_isapi_plugin.c could allow a specially crafted request to access application functionality via the reverse proxy that was not intended for clients...

CVE-2018-1323: Improper Limitation of a Pathname to a Restricted Directory

The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via IIS, then it was possible fo...

PT-2018-11712

Name of the Vulnerable Software and Affected Versions Apache Tomcat JK ISAPI Connector versions 1.2.0 through 1.2.42 Description The issue concerns the normalization of requested paths in the Apache Tomcat JK ISAPI Connector. It did not handle certain edge cases correctly, potentially allowing a...