CVE-2020-1938VulnerabilityPublished 03/03/2022Updated 10/24/2026

CVE-2020-1938: Apache Tomcat Improper Privilege Management Vulnerability

Affects Apache TomcatSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/03/2022
KEV deadline: 03/17/2022
EPSS: 99.3% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2020-1938 (opens in a new tab)

Description

CVE-2020-1938 is a vulnerability in Apache Tomcat where the Apache JServ Protocol (AJP) connections are treated with higher trust than HTTP connections. This improper privilege management can be exploited if an attacker gains access to AJP connections.

Summary

Apache Tomcat improperly manages privileges by treating Apache JServ Protocol (AJP) connections as more trusted than equivalent HTTP connections. This trust assumption can be exploited by attackers who have access to AJP connections, potentially leading to unauthorized actions or access within the Tomcat server environment.

Impact

Attackers with access to AJP connections can exploit this vulnerability to perform unauthorized actions due to the elevated trust level assigned to these connections by Apache Tomcat. This can lead to compromise of the server or unauthorized access to resources managed by Tomcat.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is confirmed, restrict access to AJP ports to trusted hosts only and disable the AJP connector if it is not required.

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 10:41:25 UTC

References

Related threats