Kazu Nambo reports:
URL decoding the the Apache webserver prior to decoding in the Tomcat server could pypass access control rules and give access to pages on a different AJP by sending a crafted URL. [source]
URL decoding the the Apache webserver prior to decoding in the Tomcat server could pypass access control rules and give access to pages on a different AJP by sending a crafted URL.
Copyright © 2003-2005 Jacques Vidrine and contributors. Please see the source of this document for full copyright information.