GHSA-hr63-37xg-3w68

GHSA-hr63-37xg-3w68 PUBLISHED CVSS 8.699999809265137 HIGH

Record from GitHub Advisory Database · Published May 1, 2022

mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.

Risk scores

CVSS 4.0

8.699999809265137

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Timeline

May 1, 2022 CVE Published
Apr 9, 2026 Distribution Patch
Apr 30, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-hr63-37xg-3w68
vulnetix vdb fixes GHSA-hr63-37xg-3w68

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-hr63-37xg-3w68/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

…and 24 more

Look up in the Resolve Platform →