CVE-2018-11759

83

FAUCET Score

CVE-2018-11759 describes a path normalization flaw in Apache Tomcat JK Connector versions 1.2.0 to 1.2.44, impacting Apache httpd and various Linux distributions. This high-severity vulnerability (CVSS 7.5) allows unauthenticated attackers to bypass access controls or expose unintended application functionality via specially crafted requests. While not actively exploited in the wild and lacking public exploit code, Nuclei templates exist for detecting manager access, and its high EPSS score indicates a significant likelihood of future exploitation.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 1.2.0, <= 1.2.44CPE matchmatch criteria	cpe:2.3:a:apache:tomcat_jk_connector::::::::
		8.0CPE matchmatch criteria	cpe:2.3:o:debian:debian_linux:8.0:::::::*
		9.0CPE matchmatch criteria	cpe:2.3:o:debian:debian_linux:9.0:::::::*
		Range not provided by sourceCPE matchmatch criteria	cpe:2.3:a:redhat:jboss_core_services:-:::::::*

CVSS Data

CVSS version used by this source: 3.0

7.5HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

Exploitability Score

3.9

Impact Score

3.6

CvssVersion

3.0

Exploit Intelligence

EPSS Score

90.65%

Probability of exploitation in next 30 days

EPSS Percentile

99.8%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

Nuclei: CVE-2018-11759 · Jul 6, 2020

This CVE's current EPSS score of 0.9065 is in the 100th percentile among its peer group of 51,551 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (22)

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-0:1-6.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-apache-commons-daemon-jsvc-1:1.1.0-3.redhat_2.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-apr-0:1.6.3-31.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-apr-util-0:1.6.1-24.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-httpd-0:2.4.29-35.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-mod_cluster-native-0:1.3.8-3.Final_redhat_2.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-mod_jk-0:1.2.46-1.redhat_1.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-nghttp2-0:1.29.0-9.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-openssl-1:1.0.2n-14.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-0:1-6.jbcs.el7

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-apache-commons-daemon-jsvc-1:1.1.0-3.redhat_2.jbcs.el7

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-apr-0:1.6.3-31.jbcs.el7

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-apr-util-0:1.6.1-24.jbcs.el7

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-httpd-0:2.4.29-35.jbcs.el7

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_cluster-native-0:1.3.8-3.Final_redhat_2.jbcs.el7

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_jk-0:1.2.46-1.redhat_1.jbcs.el7

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-nghttp2-0:1.29.0-9.jbcs.el7

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-openssl-1:1.0.2n-14.jbcs.el7

redhatpatch availablevia redhat_api

Product: Text-Only JBCS

redhatno patchvia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 6Fixed in: mod_jk

redhatend of lifevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 5Fixed in: mod_jk

redhatend of lifevia redhat_api

Product: Red Hat JBoss Enterprise Web Server 2Fixed in: mod_jk

Vendor Advisories (1)

redhatCVE-2018-11759Important

mod_jk: connector path traversal due to mishandled HTTP requests in httpd

References

access.redhat.com / errata/RHSA-2019:0366

Third Party Advisory

access.redhat.com / errata/RHSA-2019:0367

Third Party Advisory

lists.apache.org / thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/6d564bb0ab73d6b3efdd1d6b1c075d1a2c84ecd84a4159d6122529ad%40%3Cannounce.tomcat.apache.org%3E

lists.apache.org / thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c%40%3Cdev.tomcat.apache.org%3E

lists.apache.org / thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E

lists.debian.org / debian-lts-announce/2018/12/msg00007.html

Mailing ListThird Party Advisory

debian.org / security/2018/dsa-4357

Third Party Advisory

oracle.com / security-alerts/cpujan2020.html

securityfocus.com / bid/105888

Third Party AdvisoryVDB Entry