CVE-2014-8111

mod_jk: information leak due to incorrect JkMount/JkUnmount directives processing

Published Apr 21, 2015 CVSS 2.0 · 5.0 Medium EPSS 7.1% KEV · Not listed
Description
Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores JkUnmount rules for subtrees of previous JkMount rules, which allows remote attackers to access otherwise restricted artifacts via unspecified vectors.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-240-1 libapache-mod-jk security update
Debian DSA Debian DSA DSA-3278-1 libapache-mod-jk security update
EUVD EUVD EUVD-2014-7957 Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores JkUnmount rules for subtrees of previous JkMount rules, which allows remote attackers to access otherwise restricted artifacts via unspecified vectors.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 6, 2024, 1:10 PM
Reserved
Oct 10, 2014, 12:00 AM
Status
Modified
Published
Apr 21, 2015, 5:59 PM
Modified
Jun 17, 2026, 12:16 AM
Severity
Moderate
Public date
Apr 14, 2015, 12:00 AM