Vulnerability · Published Sep 23, 2024 · Assigned by apache
CVE-2024-46544Apache Tomcat Connectors: mod_jk: local users can view and modify configuration
Medium 5.9
In plain English
A medium-severity incorrect default permissions in Apache Tomcat Connectors from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration which may lead to information disclosure and/or denial of service. This issue affects Apache Tomcat Connectors: from 1.2.9-beta through 1.2.49. Only mod_jk on Unix like systems is affected. Neither the ISAPI redirector nor mod_jk on Windows is affected. Users are recommended to upgrade to version 1.2.50, which fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | mod_jk | 1.2.50-1.el9_4.1 | ALSA-2024:7457 |
| Debian:12 | libapache-mod-jk | 1:1.2.48-2+deb12u2 | DEBIAN-CVE-2024-46544 |
| Debian:13 | libapache-mod-jk | 1:1.2.50-1 | DEBIAN-CVE-2024-46544 |
| Debian:14 | libapache-mod-jk | 1:1.2.50-1 | DEBIAN-CVE-2024-46544 |
| Rocky Linux:9 | mod_jk | 0:1.2.50-1.el9_4.1 | RLSA-2024:7457 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Tomcat Connectors | 1.2.9-beta – through 1.2.49 |
Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L