CVE-2024-46544
Apache Tomcat Connectors: mod_jk: local users can view and modify configuration
Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration which may lead to information disclosure and/or denial of service.
This issue affects Apache Tomcat Connectors: from 1.2.9-beta through 1.2.49. Only mod_jk on Unix like systems is affected. Neither the ISAPI redirector nor mod_jk on Windows is affected.
Users are recommended to upgrade to version 1.2.50, which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Apache Tomcat Connectors: mod_jk: local users can view and modify configuration
Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration which may lead to information disclosure and/or denial of service.
This issue affects Apache Tomcat Connectors: from 1.2.9-beta through 1.2.49. Only mod_jk on Unix like systems is affected. Neither the ISAPI redirector nor mod_jk on Windows is affected.
Users are recommended to upgrade to version 1.2.50, which fixes the issue.
- Record
CVE-2024-46544- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-276
- Updated
- 2026-11-02
EUVDEUVD-2024-41869
Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration which may lead to information disclosure and/or denial of service.
This issue affects Apache Tomcat Connectors: from 1.2.9-beta through 1.2.49. Only mod_jk on Unix like systems is affected. Neither the ISAPI redirector nor mod_jk on Windows is affected.
Users are recommended to upgrade to version 1.2.50, which fixes the issue.
- Record
EUVD-2024-41869- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2582-53pq-96cq
Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to...
Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration which may lead to information disclosure and/or denial of service.
This issue affects Apache Tomcat Connectors: from 1.2.9-beta through 1.2.49. Only mod_jk on Unix like systems is affected. Neither the ISAPI redirector nor mod_jk on Windows is affected.
Users are recommended to upgrade to version 1.2.50, which fixes the issue.
- Record
GHSA-2582-53pq-96cq- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-276
- Updated
- 2026-11-02
NVD
Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration which may lead to information disclosure and/or denial of service.
This issue affects Apache Tomcat Connectors: from 1.2.9-beta through 1.2.49. Only mod_jk on Unix like systems is affected. Neither the ISAPI redirector nor mod_jk on Windows is affected.
Users are recommended to upgrade to version 1.2.50, which fixes the issue.
- Record
CVE-2024-46544- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-276
- Updated
- 2026-11-02
OSV
Apache Tomcat Connectors: mod_jk: local users can view and modify configuration
Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration which may lead to information disclosure and/or denial of service.
This issue affects Apache Tomcat Connectors: from 1.2.9-beta through 1.2.49. Only mod_jk on Unix like systems is affected. Neither the ISAPI redirector nor mod_jk on Windows is affected.
Users are recommended to upgrade to version 1.2.50, which fixes the issue.
- Record
CVE-2024-46544- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-276
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-46544
Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration which may lead to information disclosure and/or denial of service. This issue affects Apache Tomcat Connectors: from 1.2.9-beta through 1.2.49. Only mod_jk on Unix like systems is affected. Neither the ISAPI redirector nor mod_jk on Windows is affected. Users are recommended to upgrade to version 1.2.50, which fixes the issue.
- Record
DEBIAN-CVE-2024-46544- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Show 12 moreShow less
OSVRHSA-2024:6927
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP6 security update
- Record
RHSA-2024:6927- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2024:7457
Red Hat Security Advisory: mod_jk bug fix update
- Record
RHSA-2024:7457- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2024:8928
Red Hat Security Advisory: mod_jk security update
- Record
RHSA-2024:8928- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2024:8929
Red Hat Security Advisory: mod_jk security update
- Record
RHSA-2024:8929- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRLSA-2024:7457
Moderate: mod_jk bug fix update
The mod_jk module is an Apache HTTP Server plug-in that enables the Apache HTTP Server to connect with the Apache Tomcat servlet engine.
Bug Fix(es):
- Rebase to upstream 1.2.50 release (JIRA:Rocky Linux-58855)
Security fix(es):
- mod_jk: information Disclosure / DoS (CVE-2024-46544) (JIRA:Rocky Linux-59800)
- Record
RLSA-2024:7457- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-46544
Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration which may lead to information disclosure and/or denial of service. This issue affects Apache Tomcat Connectors: from 1.2.9-beta through 1.2.49. Only mod_jk on Unix like systems is affected. Neither the ISAPI redirector nor mod_jk on Windows is affected. Users are recommended to upgrade to version 1.2.50, which fixes the issue.
- Record
UBUNTU-CVE-2024-46544- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVALSA-2024:7457 No score
Moderate: mod_jk bug fix update
The mod_jk module is an Apache HTTP Server plug-in that enables the Apache HTTP Server to connect with the Apache Tomcat servlet engine.
Bug Fix(es):
- Rebase to upstream 1.2.50 release (JIRA:AlmaLinux-58855)
Security fix(es):
- mod_jk: information Disclosure / DoS (CVE-2024-46544) (JIRA:AlmaLinux-59800)
- Record
ALSA-2024:7457- Updated
- 2026-11-02
OSVCLSA-2026-1779204030 No score
mod_jk: Fix of CVE-2024-46544
- CVE-2024-46544: fix insecure file permissions on shared memory and lock files
- Record
CLSA-2026-1779204030- Updated
- 2026-11-02
OSVMGASA-2024-0315 No score
Updated apache-mod_jk packages fix security vulnerability
Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration which may lead to information disclosure and/or denial of service. (CVE-2024-46544)
- Record
MGASA-2024-0315- Updated
- 2026-11-02
OSVSUSE-SU-2025:0102-1 No score
Security update for apache2-mod_jk
This update for apache2-mod_jk fixes the following issues:
- Update to version 1.2.50:
- CVE-2024-46544: Fixed incorrect default permissions vulnerabilitymay that could lead to information disclosure and/or denial of service. (bsc#1230916)
- CVE-2023-41081: Fixed information disclosure in mod_jk. (bsc#1215301)
- Record
SUSE-SU-2025:0102-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:0143-1 No score
Security update for apache2-mod_jk
This update for apache2-mod_jk fixes the following issues:
- Update to version 1.2.50:
- CVE-2024-46544: Fixed incorrect default permissions vulnerabilitymay that could lead to information disclosure and/or denial of service. (bsc#1230916)
- Record
SUSE-SU-2025:0143-1- Updated
- 2026-11-02
OSVUSN-8369-1 No score
libapache-mod-jk vulnerability
It was discovered that Apache Tomcat Connectors used incorrect default permissions for shared memory on Unix-like systems. A local attacker could possibly use this issue to view or modify mod_jk configuration data in shared memory, resulting in sensitive information exposure or a denial of service.
- Record
USN-8369-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mod_jkAlmaLinux:9 |
before 1.2.50-1.el9_4.1 | 1.2.50-1.el9_4.1 |
mod_jkTuxCare:AlmaLinux:9.2 |
before 1.2.48-23.el9.tuxcare.els2 | 1.2.48-23.el9.tuxcare.els2 |
libapache-mod-jkDebian:12 |
before 1:1.2.48-2+deb12u2, plus listed versions 1:1.2.48-21:1.2.48-2+deb12u1 |
1:1.2.48-2+deb12u2 |
libapache-mod-jkDebian:13 |
before 1:1.2.50-1 | 1:1.2.50-1 |
libapache-mod-jkDebian:14 |
before 1:1.2.50-1 | 1:1.2.50-1 |
libapache-mod-jkDebian:11 |
before 1:1.2.48-1+deb11u2, plus listed versions 1:1.2.48-11:1.2.48-1+deb11u1 |
1:1.2.48-1+deb11u2 |
apache-mod_jkMageia:9 |
before 1.2.50-1.mga9 | 1.2.50-1.mga9 |
jbcs-httpd24-httpdRed Hat:jboss_core_services:1::el7 |
before 0:2.4.57-15.el7jbcs | 0:2.4.57-15.el7jbcs |
jbcs-httpd24-httpd-debuginfoRed Hat:jboss_core_services:1::el7 |
before 0:2.4.57-15.el7jbcs | 0:2.4.57-15.el7jbcs |
jbcs-httpd24-httpd-develRed Hat:jboss_core_services:1::el7 |
before 0:2.4.57-15.el7jbcs | 0:2.4.57-15.el7jbcs |
Show 46 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jbcs-httpd24-httpd-manualRed Hat:jboss_core_services:1::el7 |
before 0:2.4.57-15.el7jbcs | 0:2.4.57-15.el7jbcs |
jbcs-httpd24-httpd-selinuxRed Hat:jboss_core_services:1::el7 |
before 0:2.4.57-15.el7jbcs | 0:2.4.57-15.el7jbcs |
jbcs-httpd24-httpd-toolsRed Hat:jboss_core_services:1::el7 |
before 0:2.4.57-15.el7jbcs | 0:2.4.57-15.el7jbcs |
jbcs-httpd24-mod_ldapRed Hat:jboss_core_services:1::el7 |
before 0:2.4.57-15.el7jbcs | 0:2.4.57-15.el7jbcs |
jbcs-httpd24-mod_proxy_htmlRed Hat:jboss_core_services:1::el7 |
before 1:2.4.57-15.el7jbcs | 1:2.4.57-15.el7jbcs |
jbcs-httpd24-mod_sessionRed Hat:jboss_core_services:1::el7 |
before 0:2.4.57-15.el7jbcs | 0:2.4.57-15.el7jbcs |
jbcs-httpd24-mod_sslRed Hat:jboss_core_services:1::el7 |
before 1:2.4.57-15.el7jbcs | 1:2.4.57-15.el7jbcs |
jbcs-httpd24-httpdRed Hat:jboss_core_services:1::el8 |
before 0:2.4.57-15.el8jbcs | 0:2.4.57-15.el8jbcs |
jbcs-httpd24-httpd-debuginfoRed Hat:jboss_core_services:1::el8 |
before 0:2.4.57-15.el8jbcs | 0:2.4.57-15.el8jbcs |
jbcs-httpd24-httpd-develRed Hat:jboss_core_services:1::el8 |
before 0:2.4.57-15.el8jbcs | 0:2.4.57-15.el8jbcs |
jbcs-httpd24-httpd-manualRed Hat:jboss_core_services:1::el8 |
before 0:2.4.57-15.el8jbcs | 0:2.4.57-15.el8jbcs |
jbcs-httpd24-httpd-selinuxRed Hat:jboss_core_services:1::el8 |
before 0:2.4.57-15.el8jbcs | 0:2.4.57-15.el8jbcs |
jbcs-httpd24-httpd-toolsRed Hat:jboss_core_services:1::el8 |
before 0:2.4.57-15.el8jbcs | 0:2.4.57-15.el8jbcs |
jbcs-httpd24-httpd-tools-debuginfoRed Hat:jboss_core_services:1::el8 |
before 0:2.4.57-15.el8jbcs | 0:2.4.57-15.el8jbcs |
jbcs-httpd24-mod_ldapRed Hat:jboss_core_services:1::el8 |
before 0:2.4.57-15.el8jbcs | 0:2.4.57-15.el8jbcs |
jbcs-httpd24-mod_ldap-debuginfoRed Hat:jboss_core_services:1::el8 |
before 0:2.4.57-15.el8jbcs | 0:2.4.57-15.el8jbcs |
jbcs-httpd24-mod_proxy_htmlRed Hat:jboss_core_services:1::el8 |
before 1:2.4.57-15.el8jbcs | 1:2.4.57-15.el8jbcs |
jbcs-httpd24-mod_proxy_html-debuginfoRed Hat:jboss_core_services:1::el8 |
before 1:2.4.57-15.el8jbcs | 1:2.4.57-15.el8jbcs |
jbcs-httpd24-mod_sessionRed Hat:jboss_core_services:1::el8 |
before 0:2.4.57-15.el8jbcs | 0:2.4.57-15.el8jbcs |
jbcs-httpd24-mod_session-debuginfoRed Hat:jboss_core_services:1::el8 |
before 0:2.4.57-15.el8jbcs | 0:2.4.57-15.el8jbcs |
jbcs-httpd24-mod_sslRed Hat:jboss_core_services:1::el8 |
before 1:2.4.57-15.el8jbcs | 1:2.4.57-15.el8jbcs |
jbcs-httpd24-mod_ssl-debuginfoRed Hat:jboss_core_services:1::el8 |
before 1:2.4.57-15.el8jbcs | 1:2.4.57-15.el8jbcs |
jbcs-httpd24-mod_jkRed Hat:jboss_core_services:1::el7 |
before 0:1.2.50-3.redhat_1.el7jbcs | 0:1.2.50-3.redhat_1.el7jbcs |
jbcs-httpd24-mod_jk-ap24Red Hat:jboss_core_services:1::el7 |
before 0:1.2.50-3.redhat_1.el7jbcs | 0:1.2.50-3.redhat_1.el7jbcs |
jbcs-httpd24-mod_jk-debuginfoRed Hat:jboss_core_services:1::el7 |
before 0:1.2.50-3.redhat_1.el7jbcs | 0:1.2.50-3.redhat_1.el7jbcs |
jbcs-httpd24-mod_jkRed Hat:jboss_core_services:1::el8 |
before 0:1.2.50-3.redhat_1.el8jbcs | 0:1.2.50-3.redhat_1.el8jbcs |
jbcs-httpd24-mod_jk-ap24Red Hat:jboss_core_services:1::el8 |
before 0:1.2.50-3.redhat_1.el8jbcs | 0:1.2.50-3.redhat_1.el8jbcs |
jbcs-httpd24-mod_jk-ap24-debuginfoRed Hat:jboss_core_services:1::el8 |
before 0:1.2.50-3.redhat_1.el8jbcs | 0:1.2.50-3.redhat_1.el8jbcs |
mod_jkRed Hat:enterprise_linux:9::appstream |
before 0:1.2.50-1.el9_4.1 | 0:1.2.50-1.el9_4.1 |
mod_jk-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:1.2.50-1.el9_4.1 | 0:1.2.50-1.el9_4.1 |
mod_jk-debugsourceRed Hat:enterprise_linux:9::appstream |
before 0:1.2.50-1.el9_4.1 | 0:1.2.50-1.el9_4.1 |
mod_jkRed Hat:rhel_e4s:9.0::appstream |
before 0:1.2.50-1.el9_0.1 | 0:1.2.50-1.el9_0.1 |
mod_jk-debuginfoRed Hat:rhel_e4s:9.0::appstream |
before 0:1.2.50-1.el9_0.1 | 0:1.2.50-1.el9_0.1 |
mod_jk-debugsourceRed Hat:rhel_e4s:9.0::appstream |
before 0:1.2.50-1.el9_0.1 | 0:1.2.50-1.el9_0.1 |
mod_jkRed Hat:rhel_eus:9.2::appstream |
before 0:1.2.50-1.el9_2.1 | 0:1.2.50-1.el9_2.1 |
mod_jk-debuginfoRed Hat:rhel_eus:9.2::appstream |
before 0:1.2.50-1.el9_2.1 | 0:1.2.50-1.el9_2.1 |
mod_jk-debugsourceRed Hat:rhel_eus:9.2::appstream |
before 0:1.2.50-1.el9_2.1 | 0:1.2.50-1.el9_2.1 |
mod_jkRocky Linux:9 |
before 0:1.2.50-1.el9_4.1 | 0:1.2.50-1.el9_4.1 |
apache2-mod_jkSUSE:Linux Enterprise Module for Server Applications 15 SP6 |
before 1.2.50-150100.6.12.1 | 1.2.50-150100.6.12.1 |
apache2-mod_jkopenSUSE:Leap 15.6 |
before 1.2.50-150100.6.12.1 | 1.2.50-150100.6.12.1 |
apache2-mod_jkSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 1.2.50-7.12.1 | 1.2.50-7.12.1 |
libapache-mod-jkUbuntu:Pro:18.04:LTS |
before 1:1.2.43-1ubuntu0.1~esm2, plus listed versions 1:1.2.42-11:1.2.43-11:1.2.43-1ubuntu0.1~esm1 |
1:1.2.43-1ubuntu0.1~esm2 |
libapache-mod-jkUbuntu:Pro:20.04:LTS |
before 1:1.2.46-1ubuntu0.1+esm1, plus listed versions 1:1.2.46-11:1.2.46-1ubuntu0.1 |
1:1.2.46-1ubuntu0.1+esm1 |
libapache-mod-jkUbuntu:Pro:22.04:LTS |
before 1:1.2.48-1ubuntu0.1+esm1, plus listed versions 1:1.2.48-11:1.2.48-1ubuntu0.1 |
1:1.2.48-1ubuntu0.1+esm1 |
libapache-mod-jkUbuntu:Pro:24.04:LTS |
before 1:1.2.49-1ubuntu0.1~esm1, plus listed versions 1:1.2.48-21:1.2.49-11:1.2.49-1build1 |
1:1.2.49-1ubuntu0.1~esm1 |
libapache-mod-jkUbuntu:Pro:16.04:LTS |
before 1:1.2.41-1ubuntu0.1~esm1, plus listed versions 1:1.2.40+svn150520-11:1.2.41-1 |
1:1.2.41-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-46544 is a medium vulnerability (CVSS 5.9) in Apache Tomcat Connectors, published September 23, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 25th percentile. Fixed in mod_jk 1.2.50-1.el9_4.1.
References
lists.apache.org/thread/q1gp7cc38hs1r8gj8gfnopwznd5fpr4d
openwall.com/lists/oss-security/2024/09/23/1
lists.debian.org/debian-lts-announce/2024/10/msg00010.html
nvd.nist.gov/vuln/detail/CVE-2024-46544
github.com/advisories/GHSA-2582-53pq-96cq
access.redhat.com/errata/RHSA-2024:7457
Show 36 moreShow less
bugzilla.redhat.com/2314194
errata.almalinux.org/9/ALSA-2024-7457.html
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1779204030.html
security-tracker.debian.org/tracker/CVE-2024-46544
advisories.mageia.org/MGASA-2024-0315.html
bugs.mageia.org/show_bug.cgi?id=33586
docs.redhat.com/en/documentation/red_hat_jboss_core_services/2.4.57/html/red_hat_jboss_core_services_apache_http_server_2.4.57_service_pack_6_release_notes/index
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6927.json
cve.org/CVERecord?id=CVE-2023-38709
httpd.apache.org/security/vulnerabilities_24.html
issues.redhat.com/browse/RHEL-58855
errata.rockylinux.org/RLSA-2024:7457
suse.com/support/update/announcement/2025/suse-su-20250102-1
bugzilla.suse.com/1215301
ubuntu.com/security/CVE-2024-46544