CVE-2008-5519: The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in…

Unscored severity · published Apr 9, 2009

CVE-2008-5519

The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in…

–

CVSS

7.3%

EPSS

On KEV

Description

The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol's requirements for requests containing Content-Length headers.

Exploitation

Is it being used?

Exploit prediction (EPSS)7.3% · higher than 94% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Tomcat · Apache

4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +34 more · source: NVD

Mod JK · Apache

1.2; 1.2.1; 1.2.6; 1.2.7; 1.2.8; 1.2.9; +18 more · source: NVD