CVE-2020-1938: Apache Tomcat AJP connector file read and JSP execution flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, CISA KEV listing and an EPSS probability near 1.0 with no authentication or user interaction required make this an urgent patch-first item wherever the AJP port is exposed.

What it is

Apache Tomcat shipped an AJP Connector enabled by default that listened on all configured IP addresses, and Tomcat treats AJP connections as more trusted than HTTP. This trust gap lets an attacker who can reach the AJP port return arbitrary files from the web application and process any file in the web application as a JSP. Where file upload exists or the attacker can otherwise control web application content, this escalates to remote code execution.

Impact

An attacker gains read access to arbitrary files within the web application and can execute files as JSP, leading to remote code execution in common deployment scenarios. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact reflects full compromise potential.

Attack surface

Reached over the network via the AJP port, which was enabled by default and bound to all configured IP addresses in affected versions. No authentication or user interaction is required per the CVSS vector; exploitation only matters if the AJP port is reachable by untrusted users.

Exploitation

Listed in CISA KEV since 2022-03-03 with a required action to apply vendor updates, and EPSS shows a 30-day probability of 0.9927 (percentile 0.99936), indicating very high likelihood of exploitation activity. No ransomware campaign use is documented in the record.

What to do

• Upgrade to Apache Tomcat 9.0.31, 8.5.51, 7.0.100 or later, which hardens the default AJP Connector configuration.
• If AJP is not required, disable the AJP Connector entirely.
• If AJP is required, bind it to localhost or a trusted interface and require a strong secret, and block the AJP port from untrusted networks at the firewall.
• Review and adjust configuration after upgrading, since the changed AJP defaults may require small configuration edits.
• Apply vendor updates for downstream products listed as affected (Oracle, Debian, openSUSE, Fedora, NetApp, BlackBerry).

Detection

• Monitor network traffic to AJP ports (default 8009) from untrusted sources and alert on any external reachability.
• Inspect AJP request logs and Tomcat access logs for anomalous requests referencing files outside expected web application paths or JSP processing of uploaded content.
• Audit Tomcat server.xml for AJP Connector entries that are enabled and bound to non-loopback addresses.
• Watch for unexpected file reads or new JSP execution in web application directories that correlate with AJP traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.