CoreCVE
Back

MEDIUM

mod_jk: information leak due to incorrect JkMount/JkUnmount directives processing

Published Apr 21, 2015

Description

Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores JkUnmount rules for subtrees of previous JkMount rules, which allows remote attackers to access otherwise restricted artifacts via unspecified vectors.

Affected products

Remediation

Red Hat statement

Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates of Red Hat Enterprise Application Platform 4 and 5, and Red Hat JBoss Web Server 1. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/ and Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/. This issue did not affect Red Hat JBoss Web Server 3.x. This issue does affect Red Hat JBoss Web Server 2.x; a future update may address this issue.

Metrics

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (18)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Apr 21, 2015
Updated Aug 6, 2024
Reserved Oct 10, 2014
Link CVE-2014-8111
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2014-8111
Red Hat
Severity Moderate
Public date Apr 14, 2015
Links CVE-2014-8111 - Bugzilla