> ## Content Index
> Fetch the complete content index at: https://thenitai.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Tomcat AJP vulnerability and Razuna
- URL: https://thenitai.com/tomcat-ajp-vulnerability-and-razuna/
- Published: 2020-03-06T23:41:11.000Z
- Updated: 2020-03-06T23:41:11.000Z
- Author: Nitai
- Tags: #Import 2026-09-21 03:50

We got notified that there is an AJP security vulnerability with all Apache Tomcat releases. The issue is discussed as [CVE-2929–1938](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1938&ref=thenitai.com). A remote, unauthenticated/untrusted attacker could exploit this AJP configuration to read web application files from a server exposing the AJP port to untrusted clients.

That said, the default Tomcat instance that is included in our [Razuna download](https://razuna.org/?ref=thenitai.com) has the AJP connector **disabled by default**. Also, all customers of our [dedicated Razuna servers](https://razuna.com/?ref=thenitai.com), are **already protected**!

However, if you installed Razuna on your customer Tomcat installation, please make sure to disable the AJP connector in the server.xml file that can be found in the tomcat/config folder.

---

*Originally published at* [*Helpmonks Blog*](https://blog.helpmonks.com/tomcat-ajp-vulnerability-and-razuna/?ref=thenitai.com)*.*