CVE-2018-1323

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via IIS, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing Tomcat via the reverse proxy.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22CWE-200

Affected software

VendorProductVersions
Apache Software FoundationApache Tomcat ConnectorsApache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42

References

Timeline

Published
Mar 12, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-132307.5The sell function of a smart contract implementation for DestiNeed (DSN), an Ethereum token, has an integer overflow in which "amount * sellCVE-2018-132317.5The sell function of a smart contract implementation for ENTER (ENTR) (Contract Name: EnterToken), an Ethereum token, has an integer overfloCVE-2018-132327.5The sell function of a smart contract implementation for ENTER (ENTR) (Contract Name: EnterCoin), an Ethereum token, has an integer overflowCVE-2018-132337.5The sell function of a smart contract implementation for GSI, an Ethereum token, has an integer overflow in which "amount * sellPrice" can bCVE-2018-13245.5A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFCVE-2018-13256.1In Apache wicket-jquery-ui <= 6.29.0, <= 7.10.1, <= 8.0.0-M9.1, JS code created in WYSIWYG editor will be executed on display.CVE-2018-132506.5libming 0.4.8 has a NULL pointer dereference in the getString function of the decompile.c file, related to decompileSTRINGCONCAT. Remote attCVE-2018-132516.5In libming 0.4.8, there is an excessive memory allocation attempt in the readBytes function of the util/read.c file, related to parseSWF_DEFCVE-2018-132526.1Entrust Datacard Syntera CS 5.x has XSS via the name field of "Domain or Computer Name" in the login page.CVE-2018-132566.1PHP Scripts Mall Auditor Website 2.0.1 has XSS via the lastname or firstname parameter.CVE-2018-132576.1The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during CentralCVE-2018-132585.3Mediawiki 1.31 before 1.31.1 misses .htaccess files in the provided tarball used to protect some directories that shouldn't be web accessibl
CVE-2018-1323: High severity, CVSS 7.5 | Vulnix