CVE-2007-1860
mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within...
5.0 MediumFix available
mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.
Exploit likelihood
13.2%Up 5.8 points since Feb 4, 2022
What each source reports
NVD Score used
mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.
- Record
CVE-2007-1860- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.
- Record
CVE-2007-1860- Updated
- 2026-11-02
EUVDEUVD-2007-1854 No score
mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.
- Record
EUVD-2007-1854- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hr63-37xg-3w68 No score
mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within...
mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.
- Record
GHSA-hr63-37xg-3w68- Weakness
- CWE-22
- Updated
- 2026-11-02
OSV No score
mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.
- Record
CVE-2007-1860- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-1860 No score
mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.
- Record
DEBIAN-CVE-2007-1860- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libapache-mod-jkDebian:12 |
before 1:1.2.23-1 | 1:1.2.23-1 |
libapache-mod-jkDebian:13 |
before 1:1.2.23-1 | 1:1.2.23-1 |
libapache-mod-jkDebian:14 |
before 1:1.2.23-1 | 1:1.2.23-1 |
libapache-mod-jkDebian:4.0 |
before 1:1.2.18-3etch1, plus listed versions 1:1.2.18-3 |
1:1.2.18-3etch1 |
libapache-mod-jkDebian:3.1 |
before 1:1.2.5-2sarge1, plus listed versions 1:1.2.5-2 |
1:1.2.5-2sarge1 |
mod_jkRed Hat:rhel_application_stack:1 |
before 0:1.2.20-1.el4s1.5 | 0:1.2.20-1.el4s1.5 |
mod_jk-ap20Red Hat:rhel_application_stack:1 |
before 0:1.2.20-1.el4s1.5 | 0:1.2.20-1.el4s1.5 |
mod_jk-debuginfoRed Hat:rhel_application_stack:1 |
before 0:1.2.20-1.el4s1.5 | 0:1.2.20-1.el4s1.5 |
mod_jk-manualRed Hat:rhel_application_stack:1 |
before 0:1.2.20-1.el4s1.5 | 0:1.2.20-1.el4s1.5 |
mod_jkRed Hat:rhel_application_server:2 |
before 0:1.2.20-1jpp_2rh | 0:1.2.20-1jpp_2rh |
Show 39 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mod_jk-ap20Red Hat:rhel_application_server:2 |
before 0:1.2.20-1jpp_2rh | 0:1.2.20-1jpp_2rh |
mod_jk-debuginfoRed Hat:rhel_application_server:2 |
before 0:1.2.20-1jpp_2rh | 0:1.2.20-1jpp_2rh |
mod_jk-manualRed Hat:rhel_application_server:2 |
before 0:1.2.20-1jpp_2rh | 0:1.2.20-1jpp_2rh |
jabberdRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.0s10-3.38.rhn | 0:2.0s10-3.38.rhn |
java-1.4.2-ibmRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
java-1.4.2-ibm-develRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
jfreechartRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
openmotif21-debuginfoRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
perl-Crypt-CBCRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.24-1.el4 | 0:2.24-1.el4 |
rhn-apacheRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.3.27-36.rhn.rhel4 | 0:1.3.27-36.rhn.rhel4 |
rhn-modjk-ap13Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.2.23-2rhn.rhel4 | 0:1.2.23-2rhn.rhel4 |
rhn-modperlRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.29-16.rhel4 | 0:1.29-16.rhel4 |
rhn-modsslRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.8.12-8.rhn.10.rhel4 | 0:2.8.12-8.rhn.10.rhel4 |
tomcat5Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
jabberdRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.0s10-3.37.rhn | 0:2.0s10-3.37.rhn |
java-1.4.2-ibmRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.4.2.10-1jpp.2.el3 | 0:1.4.2.10-1jpp.2.el3 |
java-1.4.2-ibm-develRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.4.2.10-1jpp.2.el3 | 0:1.4.2.10-1jpp.2.el3 |
jfreechartRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.1.30-9.RHEL3.8 | 0:2.1.30-9.RHEL3.8 |
openmotif21-debuginfoRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.1.30-9.RHEL3.8 | 0:2.1.30-9.RHEL3.8 |
perl-Crypt-CBCRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.24-1.el3 | 0:2.24-1.el3 |
rhn-apacheRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.3.27-36.rhn.rhel3 | 0:1.3.27-36.rhn.rhel3 |
rhn-modjk-ap13Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.2.23-2rhn.rhel3 | 0:1.2.23-2rhn.rhel3 |
rhn-modperlRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.29-16.rhel3 | 0:1.29-16.rhel3 |
rhn-modsslRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.8.12-8.rhn.10.rhel3 | 0:2.8.12-8.rhn.10.rhel3 |
tomcat5Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
jabberdRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.0s10-3.38.rhn | 0:2.0s10-3.38.rhn |
java-1.4.2-ibmRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
java-1.4.2-ibm-develRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
jfreechartRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
openmotif21-debuginfoRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
perl-Crypt-CBCRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.24-1.el4 | 0:2.24-1.el4 |
rhn-apacheRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.3.27-36.rhn.rhel4 | 0:1.3.27-36.rhn.rhel4 |
rhn-modjk-ap13Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.2.23-2rhn.rhel4 | 0:1.2.23-2rhn.rhel4 |
rhn-modperlRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.29-16.rhel4 | 0:1.29-16.rhel4 |
rhn-modsslRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.8.12-8.rhn.10.rhel4 | 0:2.8.12-8.rhn.10.rhel4 |
tomcat5Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-1860 is a medium vulnerability (CVSS 5.0) in Apache Tomcat Jk Web Server Connector, published May 25, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 13.2%, the 96th percentile. Fixed in libapache-mod-jk 1:1.2.23-1.
References
debian.org/security/2007/dsa-1312
vupen.com/english/advisories/2007/2732
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6002
secunia.com/advisories/25701
securityfocus.com/bid/24147
Show 194 moreShow less
lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html
osvdb.org/34877
security.gentoo.org/glsa/glsa-200708-15.xml
redhat.com/support/errata/RHSA-2007-0379.html
securitytracker.com/id?1018138
docs.info.apple.com/article.html?artnum=306172
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
tomcat.apache.org/connectors-doc/news/20070301.html
exchange.xforce.ibmcloud.com/vulnerabilities/34496
lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2007-1860
github.com/advisories/GHSA-hr63-37xg-3w68
security-tracker.debian.org/tracker/CVE-2007-1860
access.redhat.com/errata/RHSA-2007:0379
bugzilla.redhat.com/show_bug.cgi?id=237656
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0379.json
cve.org/CVERecord?id=CVE-2007-1860
This page doesn't list everything
Left out here: 8 references. The JSON record has them.