CVE-2020-1938
Blackberry Workspaces Server 7.0.1 … 9.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2020-1938 is a critical-severity an unspecified weakness vulnerability in Blackberry Workspaces Server. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Apache Tomcat versions 9.0.0.M1 through 9.0.0.30, 8.5.0 through 8.5.50, and 7.0.0 through 7.0.99 contain a vulnerability in the default configuration of the Apache JServ Protocol (AJP) Connector. The connector is enabled by default and binds to all configured IP addresses, treating AJP traffic as inherently more trusted than equivalent HTTP connections. This permits an attacker who can reach the AJP port to retrieve arbitrary files from within a web application or to force Tomcat to interpret any file in the application as a JSP page.
An attacker with network access to the AJP endpoint can therefore read sensitive application content or achieve remote code execution when the target application permits file uploads that are stored inside the web root. The CVSS 3.1 base score is 9.8, reflecting the combination of network accessibility, lack of required authentication, and full confidentiality, integrity, and availability impact.
Apache Tomcat 9.0.31, 8.5.51, and 7.0.100 introduced hardening changes to the default AJP Connector configuration. The project states that mitigation is required only when an AJP port is reachable by untrusted parties; otherwise, administrators may simply disable the connector. Several vendor advisories, including those from the Apache project and downstream distributions, recommend upgrading or explicitly restricting AJP listener addresses and enabling the secret attribute for authentication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-0481
Vulnerability Data
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an…
more
attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
- CWE(s)
- KEV Date Added
- 03 March 2022
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.