Lucene search

Apache TomcatTOMCAT:F270B688D31CE8B4D2211FBA4D3A755C

HistorySep 11, 2024 - 12:00 a.m.

Fixed in Apache Tomcat JK Connector 1.2.50

2024-09-1100:00:00

Apache Tomcat

tomcat.apache.org

apache tomcat

jk connector

information disclosure

denial of service

cve-2024-46544

unix systems

memory mapped file

AI Score

6.3

Confidence

High

EPSS

Percentile

9.6%

JSON

Moderate: Information disclosure / Denial of service CVE-2024-46544

Incorrect default permissions for the memory mapped file configured by the JkShmFile directive on Unix like systems allows local users to view and/or modify the contents of the shared memory containing mod_jk configuration and status information. This could result in information disclosure and/or denial of service.

This was fixed with commit d55706e9.

This issue was identified by the Tomcat Security Team on 6 August 2024. The issue was made public on 23 September 2024.

Affects: JK 1.2.9-1.2.49 (mod_jk on Unix like platforms only)

Affected configurations

Vulners

Node

apachetomcat_connectorsRange≤1.2.49

apachetomcat_connectorsRange1.2.9≥

VendorProductVersionCPE
apachetomcat_connectors*cpe:2.3:a:apache:tomcat_connectors:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	tomcat_connectors	*	cpe:2.3:a:apache:tomcat_connectors::::::::