ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

Vulnerability CVE-2020-1938 reported against Tomcat / TomEE version shipped with AXA 17.3


Article ID: 195151


Updated On:


CA App Experience Analytics


The Tomcat version installed with AXA 17.3 is reported as containing vulnerability CVE-2020-1938 - how can we address this?


Release : 10.7.0

Component : APM Agents


The CVE is a false positive and there is a workaround to mitigate this as it is related to a feature that is not use in AXA. 

As per the vulnerability description below:

The TomEE/Tomcat servers  are vulnerable only when the Apache JServ Protocol (AJP) is enabled. By default AJP connector is enabled on the specific TomEE/Tomcat installations. And it is recommended that the connector should be disabled if not required. 
For AXA deployments the AJP Connector is not required and can be disabled. This will fix the vulnerability. This has been verified by disabling the AJP connector and no issues were found.

Steps to disable AJP Connector:

1. Login to the host on which AXA is installed and go to the AXA installation directory.
 cd /opt/ca/aoPlatform

2. Switch to non-root user
 su <non-root axausername>

3. Edit the server configuration file
      vi apache-tomee-plus-1.7.1/conf/server.xml

4. Comment the section where AJP Connector is enabled and save the file
 <!-- <Connector port="9009" protocol="AJP/1.3" redirectPort="8443" server=" “/> —>

5. Restart only the server.
    ./bin/ -s
  ./bin/ -s