Tomcat

Where It Sits

The small stack marks its layer. Beside it, each related technology links to its own page.

About

Tomcat is a web server that runs Java web applications. It is called a servlet container, because it runs servlets, the Java classes that answer web requests. Confluence and Jira both run inside it. It runs on the Java runtime, sometimes with Apache in front.

How to Spot It

These are signs that a system runs Tomcat, seen from outside without signing in, such as a response header, a cookie, a path or a default port. They help you find where it runs across your own estate. A version shown to the world also tells anyone scanning which flaws might apply, so it is worth hiding.

Default port

8080 (HTTP), 8009 (AJP)

Path

/manager/html

Page source

Apache Tomcat

If It Has a Flaw

Well-Known Flaws

Each flaw has a CVE id, the unique number a publicly known vulnerability is given so that every advisory names the same flaw. The id links to the advisory, and the card says what the flaw let an attacker do and how far it reached because of where Tomcat sits.

• CVE-2020-1938 (opens in a new tab)2020

  Ghostcat

  An exposed AJP connector let attackers read files and sometimes run code.

  Reach It exposed the contents of every application Tomcat hosted.

Rivals

Rivals do the same job on the same layer, so a system usually runs one of them in any one place. A flaw in a rival does not reach Tomcat.

• IIS
• Apache HTTP Server
• nginx
• Gunicorn
• Puma
• PHP-FPM

Stacks and Code

Tomcat is part of the common stacks below, and each stack's page shows who runs every layer. Its code arrives from the sources listed, and each source's page says how bad code could get in through it.

In Common Stacks

Confluence, Java on Tomcat

Its Code Comes From

Vendor Updates

Sources

• Apache Tomcat (opens in a new tab)