Test ID:	1.3.6.1.4.1.25623.1.0.108716
Category:	Web application abuses
Title:	Apache JServ Protocol (AJP) Public WAN (Internet) / Public LAN Accessible
Summary:	The script checks if the target host is running a service; supporting the Apache JServ Protocol (AJP) accessible from a public WAN (Internet) / public LAN.
Description:	Summary: The script checks if the target host is running a service supporting the Apache JServ Protocol (AJP) accessible from a public WAN (Internet) / public LAN. Vulnerability Insight: When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising (e.g. bypassing security checks, bypassing user authentication among others). Solution: Only allow access to the AJP service from trusted sources / networks. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Copyright	Copyright (C) 2020 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.