Apache mod_jk Access Control Bypass

Description

The Apache Web Server (httpd) with Apache Tomcat JK (mod_jk) Connector versions 1.2.0 to 1.2.44 contains a flaw in path normalization, allowing specially crafted requests to expose unintended application functionality or bypass access controls configured in httpd. Attackers can exploit this vulnerability to access sensitive data or perform unauthorized actions.

Recommendation

Upgrade Apache and mod_jk to the latest stable versions to patch the vulnerability.

References

• Apache HTTP Server
• Apache Tomcat
• CVE-2018-11759
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Etherpad Lite Access Restriction Bypass - CVE-2018-6835
• Apache mod_proxy 2.4.48 SSRF - CVE-2021-40438
• payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments) - CVE-2026-25574
• OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding - CVE-2026-30920

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Test Apache Tomcat and Apache Struts Vulnerabilities with SmartScanner 1-14

Complete guide to HTTP Headers for securing websites (Cheat Sheet)

Tags:

Apache

Tomcat

Access Control