PatchTheCVECVE-2020-1938: Apache Tomcat Improper Privilege Management Vulnerability
100
Patch now
CRITICAL 9.8EXPLOITEDREMOTEWATCHLISTDOWNGRADEUPGRADEMITIGATE
CVE-2020-1938 is a critical-severity flaw (CVSS 9.8) affecting geode, tomcat, fedora, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default
Why this priority
- Critical severity
- EPSS top 1%: very likely to be exploited
- Exploited in the wild (CISA KEV)
- Public exploit reference
- CISA SSVC: automatable with total technical impact
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 99.3% (top 1%) |
| CISA exploited list | Yes, fix due 2022-03-17 |
| Published | 2020-02-24 |
| Last modified | 2026-08-25 |
Last updated 2026-08-25 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Exploited Added to the CISA Known Exploited Vulnerabilities list
- Deadline CISA due date for US federal agencies to patch
- Updated Record last modified
apache geode DOWNGRADE
Affected: 1.12.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.12.0
1. Check installed version
apt-cache policy geode || rpm -q geode || geode --version
2. No fixed release: DOWNGRADE to a release before 1.12.0 (Debian / Ubuntu)
apt-cache madison geode
sudo apt install geode=<VERSION_BEFORE_1.12.0>
sudo apt-mark hold geode
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list geode
sudo dnf downgrade geode-<VERSION_BEFORE_1.12.0>
sudo dnf versionlock add geode
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
apache tomcat UPGRADE
Affected: >= 7.0.0 and < 7.0.100 · >= 8.5.0 and < 8.5.51 · >= 9.0.0 and < 9.0.31
Fixed in: 7.0.100, 8.5.51, 9.0.31
Safe to downgrade to: a release before 7.0.0
1. Check installed version
apt-cache policy tomcat || rpm -q tomcat || tomcat --version
2. UPGRADE to 7.0.100 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade tomcat
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade tomcat
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 7.0.0 (Debian / Ubuntu)
apt-cache madison tomcat
sudo apt install tomcat=<VERSION_BEFORE_7.0.0>
sudo apt-mark hold tomcat
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list tomcat
sudo dnf downgrade tomcat-<VERSION_BEFORE_7.0.0>
sudo dnf versionlock add tomcat
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
fedoraproject fedora MITIGATE
Affected: 30 · 31 · 32
Fixed in: no fixed release known
Safe to downgrade to: a release before 30
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
oracle agile engineering data management DOWNGRADE
Affected: 6.2.1.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 6.2.1.0
1. Check installed version
apt-cache policy agile-engineering-data-management || rpm -q agile-engineering-data-management || agile-engineering-data-management --version
2. No fixed release: DOWNGRADE to a release before 6.2.1.0 (Debian / Ubuntu)
apt-cache madison agile-engineering-data-management
sudo apt install agile-engineering-data-management=<VERSION_BEFORE_6.2.1.0>
sudo apt-mark hold agile-engineering-data-management
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list agile-engineering-data-management
sudo dnf downgrade agile-engineering-data-management-<VERSION_BEFORE_6.2.1.0>
sudo dnf versionlock add agile-engineering-data-management
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle agile product lifecycle management DOWNGRADE
Affected: 9.3.3 · 9.3.5 · 9.3.6
Fixed in: no fixed release known
Safe to downgrade to: a release before 9.3.3
1. Check installed version
apt-cache policy agile-product-lifecycle-management || rpm -q agile-product-lifecycle-management || agile-product-lifecycle-management --version
2. No fixed release: DOWNGRADE to a release before 9.3.3 (Debian / Ubuntu)
apt-cache madison agile-product-lifecycle-management
sudo apt install agile-product-lifecycle-management=<VERSION_BEFORE_9.3.3>
sudo apt-mark hold agile-product-lifecycle-management
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list agile-product-lifecycle-management
sudo dnf downgrade agile-product-lifecycle-management-<VERSION_BEFORE_9.3.3>
sudo dnf versionlock add agile-product-lifecycle-management
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle communications element manager DOWNGRADE
Affected: 8.1.1 · 8.2.0 · 8.2.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 8.1.1
1. Check installed version
apt-cache policy communications-element-manager || rpm -q communications-element-manager || communications-element-manager --version
2. No fixed release: DOWNGRADE to a release before 8.1.1 (Debian / Ubuntu)
apt-cache madison communications-element-manager
sudo apt install communications-element-manager=<VERSION_BEFORE_8.1.1>
sudo apt-mark hold communications-element-manager
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list communications-element-manager
sudo dnf downgrade communications-element-manager-<VERSION_BEFORE_8.1.1>
sudo dnf versionlock add communications-element-manager
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Exact fixes by distribution
A distro patch exists: prefer upgrading over downgrading.
Maven · org.apache.tomcat.embed:tomcat-embed-core · FIXED · 9.0.31 · vulnerable: >= 9.0.0, < 9.0.31 · source
Set org.apache.tomcat.embed:tomcat-embed-core to 9.0.31 or later in pom.xml or build.gradle, then rebuild and redeploy.
Fedora 46 · feh · FIXED · 3.13.1-1.fc46 · FEDORA-2026-3c76a13a4f · source
sudo dnf upgrade --advisory=FEDORA-2026-3c76a13a4f
Fedora ELN · setroubleshoot · FIXED · 3.3.37-7.eln159 · FEDORA-2026-f81b122fe1 · source
sudo dnf upgrade --advisory=FEDORA-2026-f81b122fe1
Ubuntu 22.04 · tomcat9 · NOT AFFECTED
Ubuntu 20.04 · tomcat9 · NOT AFFECTED
Ubuntu 24.04 · tomcat9 · NOT AFFECTED
Debian 12 · tomcat9 · FIXED · 9.0.31-1
sudo apt update && sudo apt install --only-upgrade tomcat9
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' tomcat9)" ge "9.0.31-1" && echo PATCHED || echo STILL-VULNERABLE
Debian 13 · tomcat9 · FIXED · 9.0.31-1
sudo apt update && sudo apt install --only-upgrade tomcat9
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' tomcat9)" ge "9.0.31-1" && echo PATCHED || echo STILL-VULNERABLE
RHEL 6 · tomcat6 · FIXED · tomcat6-6.0.24-114.el6_10
sudo dnf upgrade --advisory=RHSA-2020:0912
rpm -q tomcat6
RHEL 7 · tomcat · FIXED · tomcat-7.0.76-11.el7_7
sudo dnf upgrade --advisory=RHSA-2020:0855
rpm -q tomcat
RHEL 7.6 Extended Update Support · tomcat · FIXED · tomcat-7.0.76-10.el7_6
sudo dnf upgrade --advisory=RHSA-2020:2840
rpm -q tomcat
RHEL 5 · tomcat5 · DEFERRED
sudo yum update --advisory=ALAS2-2020-1402
sudo yum update --advisory=ALAS-2020-1353
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- GitHub PoC: 00theway/Ghostcat-CNVD-2020-10487 (422 stars)
- GitHub PoC: lizhianyuguangming/TomcatScanPro (297 stars)
- GitHub PoC: bkfish/CNVD-2020-10487-Tomcat-Ajp-lfi-Scanner (294 stars)
- Write-up: www.oracle.com/security-alerts/cpujan2021.html
- Exploit-DB: Apache Tomcat - AJP 'Ghostcat File Read/Inclusion
- Exploit-DB: Apache Tomcat - AJP 'Ghostcat' File Read/Inclusion (Metasploit)
- Metasploit: Apache Tomcat AJP File Read
- Nuclei scan template: Ghostcat - Apache Tomcat - AJP File Read/Inclusion Vulnerability
Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-1938?
geode: downgrade or apply the listed mitigation; tomcat: upgrade to 7.0.100, 8.5.51, 9.0.31; fedora: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2020-1938 being exploited?
Yes. CVE-2020-1938 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.
What does CVE-2020-1938 affect?
CVE-2020-1938 affects geode, tomcat, fedora. Severity is critical (CVSS 9.8). When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are a
How urgent is CVE-2020-1938?
Priority 100/100. Critical severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action; On your watchlist
Software pages
Related CVEs
- CVE-2025-47410 HIGH 8.8 UPGRADE Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that
- CVE-2024-44088 MEDIUM 6.1 UPGRADE Malicious script injection ('Cross-site Scripting') vulnerability in Apache Geode web-api (REST)
- CVE-2022-37023 MEDIUM 6.5 UPGRADE Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using RE
- CVE-2022-37022 HIGH 8.8 UPGRADE Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when
- CVE-2022-37021 CRITICAL 9.8 UPGRADE Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data fl