CVE-2020-1938

CRITICAL(9.8)KEVLikely Exploited

Apache Tomcat Improper Privilege Management Vulnerability

Description

CVE-2020-1938 is a critical-severity security vulnerability affecting Apache Tomcat. Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 94.47% (100.0th percentile), this vulnerability has a notable probability of exploitation.

KEV Information

Vendor
Apache
Product
Tomcat
Date Added
March 3, 2022
Due Date
March 17, 2022
Required Action
Apply updates per vendor instructions.

CVSS Score

Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in Calculator
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9

Affected Products

VendorProductVersion
apachegeode1.12.0
apachetomcat>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31
fedoraprojectfedora30; 31; 32
oracleagile engineering data management6.2.1.0
oracleagile plm9.3.3; 9.3.5; 9.3.6
oraclecommunications element manager8.1.1; 8.2.0; 8.2.1
oraclecommunications instant messaging server10.0.1.4.0
oraclehealth sciences empirica inspections1.0.1.2
oraclehealth sciences empirica signal7.3.3
oraclehospitality guest access4.2.0; 4.2.1
oracleinstantis enterprisetrack>= 17.1, <= 17.3
oraclemysql enterprise monitor<= 4.0.12; >= 8.0.0, <= 8.0.20
oraclesiebel ui framework<= 20.5
oracletransportation management6.3.7
oracleworkload manager12.2.0.1; 18c; 19c
debiandebian linux8.0; 9.0; 10.0
opensuseleap15.1
blackberrygood control<= 5.2.58.38
blackberryworkspaces server7.0.1; 7.1.2; 8.1.0; 9.0
netappdata availability services-

Multiple CVSS Assessments

Source: [email protected](Primary)
9.8
CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0(Secondary)
9.8
CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Weakness Type

Unspecified Weakness

No specific CWE has been assigned to this vulnerability. The underlying weakness type is not publicly categorized, but the vulnerability's impact is well-documented through its inclusion in the CISA KEV catalog.

Impact Analysis

CVE-2020-1938 carries a CVSS 3.1 score of 9.8 (CRITICAL), indicating a maximum-severity threat. The vulnerability is exploitable over the network with low attack complexity and requires no authentication. Successful exploitation can severely compromise data confidentiality, and allow unauthorized modification of data and systems, and cause complete service disruption. Organizations running affected Tomcat deployments face significant operational risk if this vulnerability remains unpatched.

Exploit Maturity

CVE-2020-1938 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 94.47% (100.0th percentile) reflects an exceptionally high probability of exploitation. Public exploit code is available, which lowers the barrier for attackers and increases the urgency of remediation. Federal agencies were required to remediate this vulnerability by 2022-03-17 per CISA's binding operational directive.

Remediation

  1. Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions.
  2. Verify that all instances of affected products (apache geode 1.12.0; apache tomcat >= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31; fedoraproject fedora 30; 31; 32) have been updated to patched versions.
  3. If immediate patching is not possible, restrict network access to affected systems using firewall rules and network segmentation to limit exposure.
  4. Monitor systems for indicators of compromise, including unusual process activity, unexpected network connections, and unauthorized configuration changes.
  5. Review security logs and conduct threat hunting to determine if the vulnerability was exploited prior to patching.

Technical Details

CVE-2020-1938 affects Apache Tomcat. Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited. The attack vector is network-based, meaning an attacker can exploit this vulnerability remotely without physical access to the target system. The maximum CVSS score of 9.8 reflects the combination of easy exploitability and severe impact across confidentiality, integrity, and availability.

Frequently Asked Questions

Is CVE-2020-1938 being actively exploited?

Yes. CVE-2020-1938 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 94.47% (100.0th percentile) further indicates a very high exploitation probability.

What products are affected by CVE-2020-1938?

CVE-2020-1938 affects Apache Tomcat. Specifically affected products include: apache geode (1.12.0), apache tomcat (>= 7.0.0, < 7.0.100; >= 8.5.0, < 8.5.51; >= 9.0.0, < 9.0.31), fedoraproject fedora (30; 31; 32), oracle agile engineering data management (6.2.1.0), oracle agile plm (9.3.3; 9.3.5; 9.3.6).

How do I fix CVE-2020-1938?

Apply updates per vendor instructions. Ensure all affected systems are updated to the latest patched versions. If patching is not immediately possible, implement network-level mitigations to limit exposure.

How severe is CVE-2020-1938?

CVE-2020-1938 has a CVSS 3.1 score of 9.8 (CRITICAL). This is a critical-severity vulnerability that requires immediate attention and remediation.

CVSS Score

9.8
CRITICAL(9.8)

EPSS Score

EPSS Score99.27%
EPSS Percentile99.9%

Dates

PublishedFebruary 24, 2020
Last ModifiedJune 17, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch