Apache Tomcat JK Connector Double Encoding Security Bypass Vulnerability

Apache HTTP server running with the Tomcat JK Web Server Connector is prone to a security-bypass vulnerability because it decodes request URLs multiple times.

Exploiting this issue allows attackers to access restricted files in the Tomcat web directory. This can expose sensitive information that could help attackers launch further attacks.

This issue is present in versions prior to Apache Tomcat JK Connector 1.2.23.


 

Privacy Statement
Copyright 2010, SecurityFocus