漏洞描述
ApacheTomcat会开启AJP连接器,方便与其他Web服务器通过AJP协议进行交互。由于Tomcat本身也内含了HTTP服务器，因此也可以视作单独的Web服务器。此漏洞为文件包含漏洞,攻击者可利用该漏洞读取或包含Tomcat 上所有 webapp 目录下的任意文件。
Apache Tomcat Ajp webapp 任意文件读取漏洞(CVE-2020-1938)
PoC代码
暂无相关漏洞推荐
- Apache Tomcat URL重写绕过漏洞 （CVE-2025-55752）
- tomcat-default-login: Apahce Tomcat Manager Default Login
- POC CVE-2020-13935: Apache Tomcat WebSocket Frame Payload Length Validation Denial of Service
- POC CVE-2007-2449: Apache Tomcat 4.x-7.x - Cross-Site Scripting
- CVE-2016-8735: Apache Tomcat - Remote Code Execution via JMX Ports
- POC CVE-2017-12615: Apache Tomcat Servers - Remote Code Execution
- POC CVE-2017-12617: Apache Tomcat - Remote Code Execution
- POC CVE-2018-11759: Apache Tomcat JK Connect <=1.2.44 - Manager Access
- POC CVE-2018-11784: Apache Tomcat - Open Redirect
- POC CVE-2019-0221: Apache Tomcat - Cross-Site Scripting
- POC CVE-2019-0232: Apache Tomcat `CGIServlet` enableCmdLineArguments - Remote Code Execution
- POC CVE-2020-9484: Apache Tomcat Remote Command Execution
- POC CVE-2025-24813: Apache Tomcat Path Equivalence - Remote Code Execution