Karl Von Randow

**Name of the Vulnerable Software and Affected Versions** Apache Tomcat Connectors versions 1.2.0 through 1.2.48 **Description** The mod jk component of Apache Tomcat Connectors is affected by an issue where, in certain circumstances, such as when a configuration includes "JkOptions +ForwardDirectories" but does not provide explicit mounts for all possible proxied requests, mod jk would use an implicit mapping and map the request to the first defined worker. This could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. The issue is resolved in version 1.2.49, where the implicit mapping functionality has been removed, and all mappings must now be via explicit configuration. **Recommendations** Upgrade to version 1.2.49, which fixes the issue.