CVE-2020-1938

An improperly managed privilege escalation in Apache Tomcat allowed attackers to bypass trust boundaries via AJP connections, leading to remote code execution.

Apache Tomcat treated Apache JServ Protocol (AJP) connections as inherently more trusted than HTTP connections, allowing attackers to exploit this privilege management flaw to execute arbitrary code remotely. This failure is critical for DIB organizations because it directly enables remote code execution (RCE), violates CMMC/NIST 800-171 requirements for patch management and access control, and can lead to full system compromise. Organizations must ensure Tomcat is patched to the latest version and restrict AJP connections to trusted internal networks only.

Shame score — A fundamental design flaw in privilege management that was actively exploited in the wild (KEV) to achieve remote code execution, demonstrating severe negligence in securing a widely deployed web server.