{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2018-11759/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2018-11759/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2018-11759/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2018-11759/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2018-11759/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2018-11759"},"sightings":{"href":"/api/v1/sightings/cve-2018-11759"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.90647,"kev":false,"percentile":0.99798},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2018/CVE-2018-11759.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2018-11759\n\ninfo:\n  name: Apache Tomcat JK Connect <=1.2.44 - Manager Access\n  author: harshbothra_\n  severity: high\n  description: |\n    Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 allows specially constructed requests to expose application functionality through the reverse proxy. It is also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical.\n  impact: |\n    Unauthenticated attackers can gain unauthorized access to the Apache Tomcat Manager interface, potentially leading to further compromise of the server.\n  remediation: |\n    Upgrade to a patched version of Apache Tomcat JK Connect (1.2.45 or higher) or apply the recommended security patches.\n  reference:\n    - https://github.com/immunIT/CVE-2018-11759\n    - https://lists.apache.org/thread.html/6d564bb0ab73d6b3efdd1d6b1c075d1a2c84ecd84a4159d6122529ad@%3Cannounce.tomcat.apache.org%3E\n    - https://lists.debian.org/debian-lts-announce/2018/12/msg00007.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2018-11759\n    - https://access.redhat.com/errata/RHSA-2019:0366\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2018-11759\n    cwe-id: CWE-22\n    epss-score: 0.90647\n    epss-percentile: 0.99798\n    cpe: cpe:2.3:a:apache:tomcat_jk_connector:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 2\n    vendor: apache\n    product: tomcat_jk_connector\n    shodan-query:\n      - title:\"Apache Tomcat\"\n      - http.title:\"apache tomcat\"\n    fofa-query: title=\"apache tomcat\"\n    google-query: intitle:\"apache tomcat\"\n  tags: cve2018,cve,apache,tomcat,httpd,mod-jk,vkev,vuln\n\nhttp:\n  - method: GET\n    path:\n      - '{{BaseURL}}/jkstatus'\n      - '{{BaseURL}}/jkstatus;'\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        words:\n          - \"JK Status Manager\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100ee1f07df68f16bf7b2d2fa3d5f7e14be523ad9d6135705f335a64dbbc6b31a51022050f2afbcb59d2f3defd3bd1760d3e593f4c6a79f090256a06765ccd0caeb0f0f:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2018-11759"}