漏洞描述
Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 allows specially constructed requests to expose application functionality through the reverse proxy. It is also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
github.comhttps://github.com/immunIT/CVE-2018-11759↗lists.apache.orghttps://lists.apache.org/thread.html/6d564bb0ab73d6b3efdd1d6b1c075d1a2c84ecd84a4159d6122529ad@%3Cannounce.tomcat.apache.org%3E↗lists.debian.orghttps://lists.debian.org/debian-lts-announce/2018/12/msg00007.html↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2018-11759↗access.redhat.comhttps://access.redhat.com/errata/RHSA-2019:0366↗