Vulnerability library
Security checkMay 13, 2024

Apache mod_jk Access Control Bypass

Understand the exposure, see the recommended fix, and check whether your own website has related weaknesses.

High severityApacheTomcatAccess Control

Check your website

Find this and other vulnerabilities with a free scan.

Your scan runs on your computer. No account required.

Description

The Apache Web Server (httpd) with Apache Tomcat JK (mod_jk) Connector versions 1.2.0 to 1.2.44 contains a flaw in path normalization, allowing specially crafted requests to expose unintended application functionality or bypass access controls configured in httpd. Attackers can exploit this vulnerability to access sensitive data or perform unauthorized actions.

Recommendation

Upgrade Apache and mod_jk to the latest stable versions to patch the vulnerability.

References

Could your website be exposed too?

SmartScanner can check your website for Apache mod_jk Access Control Bypass and gives you actionable findings to investigate.

Start a free scan

Related Issues

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Test Apache Tomcat and Apache Struts Vulnerabilities with SmartScanner 1-14

Complete guide to HTTP Headers for securing websites (Cheat Sheet)

See something that needs correcting? Let us knowUpdated May 13, 2024