StackRadar

CVE-2020-1938

CriticalKEV

Advisory

Published 15 Jun 2020In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.993
100th percentile
CISA KEV
Listed
since 3 Mar 2022
Charts affected
35
of 17,781 indexed, latest versions
Container images
33
deployed by those charts
Fix available
1 of 1
affected package

Improper Privilege Management in Tomcat

Carried by container images the latest versions of 35 of 17,781 indexed charts deploy, on 33 images.

Affected packageAffected versionsFixed inImages
tomcat-embed-coremaven8.5.4, 8.5.11, 8.5.14, 8.5.15+15 more8.5.51, 9.0.3133
OSV records
GHSA-c9hw-wf7x-jp9j
Also known as
BIT-tomcat-2020-1938

Charts affected

35 by stars
ChartLatestAffected imagesRadar Score
microcksmicrocksOfficialVerified publisher0.8.0-helm-3.kube-1.171 of 5See more

microcks microcks 0.8.0-helm-3.kube-1.17

1 of the 5 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
microcks/microcks:0.8.0e3a3e0c67b09
tomcat-embed-core@8.5.34
8.5.51

Open the chart page →

10,732
rocketmqgin1.1.02 of 2See more

rocketmq gin 1.1.0

2 of the 2 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
apache/rocketmq:4.9.35ac2a4e0f627
tomcat-embed-core@8.5.46
8.5.51
apacherocketmq/rocketmq-dashboard:1.0.024799aff6cf8
tomcat-embed-core@9.0.29
9.0.31

Open the chart page →

9,154
graphql-hivegraphql-hive1.0.01 of 17See more

graphql-hive graphql-hive 1.0.0

1 of the 17 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
supertokens/supertokens-postgresql:3.1418d34c781347
tomcat-embed-core@8.5.47
8.5.51

Open the chart page →

10,311
skywalkingkubesphere-testVerified publisher3.1.01 of 4See more

skywalking kubesphere-test 3.1.0

1 of the 4 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
apache/skywalking-ui:8.1.067d50e4deff4
tomcat-embed-core@8.5.29
8.5.51

Open the chart page →

18,042
spinnakerdwardu-helm-charts2.2.61 of 2See more

spinnaker dwardu-helm-charts 2.2.6

1 of the 2 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
gcr.io/spinnaker-marketplace/halyard:1.32.00ee5f968d2ab
tomcat-embed-core@9.0.30
9.0.31

Open the chart page →

8,752
supertokensgraphql-hive-subcharts1.0.01 of 1See more

supertokens graphql-hive-subcharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
supertokens/supertokens-postgresql:3.1418d34c781347
tomcat-embed-core@8.5.47
8.5.51

Open the chart page →

2,709
seldon-coreseldon0.2.72 of 3See more

seldon-core seldon 0.2.7

2 of the 3 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
seldonio/apife:0.2.7ba81b17f00eb
tomcat-embed-core@8.5.34
8.5.51
seldonio/cluster-manager:0.2.729e362bb1ba2
tomcat-embed-core@8.5.34
8.5.51

Open the chart page →

13,798
apache-iotdbapache-iotdb-single-nodeVerified publisher0.1.01 of 1See more

apache-iotdb apache-iotdb-single-node 0.1.0

1 of the 1 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
apache/iotdb:0.11.28647309f95d1
tomcat-embed-core@8.5.32
8.5.51

Open the chart page →

5,277
event-store-servicechoerodon0.8.01 of 2See more

event-store-service choerodon 0.8.0

1 of the 2 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
choerodon/event-store-service:0.8.03c94c97f6f69
tomcat-embed-core@8.5.14
8.5.51

Open the chart page →

9,808
unificloudnativeapp0.4.21 of 1See more

unifi cloudnativeapp 0.4.2

1 of the 1 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
jacobalberty/unifi:5.10.19c409924e2463
tomcat-embed-core@8.5.34
8.5.51

Open the chart page →

22,442
pulsarcnieg1.0.81 of 2See more

pulsar cnieg 1.0.8

1 of the 2 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
tomcat-embed-core@8.5.31
8.5.51

Open the chart page →

16,860
forwardauthdniel2.0.131 of 1See more

forwardauth dniel 2.0.13

1 of the 1 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
dniel/forwardauth:latestf67129ea1c64
tomcat-embed-core@9.0.21
9.0.31

Open the chart page →

4,592
shenyuerdeng2.4.211 of 2See more

shenyu erdeng 2.4.21

1 of the 2 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
apache/shenyu-admin:2.4.2e8b7c4ddd069
tomcat-embed-core@9.0.29
9.0.31

Open the chart page →

12,513
scorpio-brokerfiware0.3.31 of 10See more

scorpio-broker fiware 0.3.3

1 of the 10 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
scorpiobroker/scorpio:config-server_1.1.0c46c1517e523
tomcat-embed-core@9.0.26
9.0.31

Open the chart page →

55,600
scorpiobrokerfiware0.1.21 of 10See more

scorpiobroker fiware 0.1.2

1 of the 10 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
scorpiobroker/scorpio:config-server_1.1.0c46c1517e523
tomcat-embed-core@9.0.26
9.0.31

Open the chart page →

55,600
my-chartfleet-web-app0.1.02 of 6See more

my-chart fleet-web-app 0.1.0

2 of the 6 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
richardchesterwood/k8s-fleetman-api-gateway:release2518f946b9f05
tomcat-embed-core@8.5.11
8.5.51
richardchesterwood/k8s-fleetman-position-tracker:release336c43961214c
tomcat-embed-core@8.5.4
8.5.51

Open the chart page →

24,296
rocketmqgengxiankun-charts0.3.01 of 1See more

rocketmq gengxiankun-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
apache/rocketmq:5.3.0434d8398f996
tomcat-embed-core@8.5.46
8.5.51

Open the chart page →

4,921
supertokensgraphql-hive1.0.01 of 1See more

supertokens graphql-hive 1.0.0

1 of the 1 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
supertokens/supertokens-postgresql:3.1418d34c781347
tomcat-embed-core@8.5.47
8.5.51

Open the chart page →

2,709
springboothelmcharts1.0.01 of 1See more

springboot helmcharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
kimb88/hello-world-spring-boot:latest0639155241cb
tomcat-embed-core@8.5.32
8.5.51

Open the chart page →

6,451
ibm-microclimateibm-charts0.1.02 of 8See more

ibm-microclimate ibm-charts 0.1.0

2 of the 8 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
ibmcom/microclimate-file-watcher:latestab3fd1fdfa18
tomcat-embed-core@8.5.15
8.5.51
ibmcom/microclimate-theia:lateste17bdccc5030
tomcat-embed-core@8.5.15
8.5.51

Open the chart page →

57,669
kanbanapp-demokanbanapp-demo0.3.01 of 3See more

kanbanapp-demo kanbanapp-demo 0.3.0

1 of the 3 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
sdandey/dandey-apps:kanban-board-kanban-appbef0f599737b
tomcat-embed-core@9.0.21
9.0.31

Open the chart page →

7,498
ladeitladeit0.4.01 of 2See more

ladeit ladeit 0.4.0

1 of the 2 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
ladeit/ladeit:latest962b665ffe82
tomcat-embed-core@9.0.13
9.0.31

Open the chart page →

26,356
pulsarv2milvus-helm2.7.81 of 4See more

pulsarv2 milvus-helm 2.7.8

1 of the 4 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
tomcat-embed-core@8.5.31
8.5.51

Open the chart page →

15,855
cdn-remoteopencord0.2.41 of 3See more

cdn-remote opencord 0.2.4

1 of the 3 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
omecproject/cdn-antmedia:1.0.0b4ae7d0d6b74
tomcat-embed-core@8.5.38
8.5.51

Open the chart page →

63,223
ves-agentopencord1.0.21 of 1See more

ves-agent opencord 1.0.2

1 of the 1 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
opencord/ves-agent:1.0.04187e2a8c918
tomcat-embed-core@8.5.31
8.5.51

Open the chart page →

6,350
issuegenopsmxVerified publisher1.0.21 of 1See more

issuegen opsmx 1.0.2

1 of the 1 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
opsmx11/issuegen:v2.1.05c50ca123d88
tomcat-embed-core@9.0.26
9.0.31

Open the chart page →

26,339
helloworldpauls-helm-charts2.0.01 of 1See more

helloworld pauls-helm-charts 2.0.0

1 of the 1 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
paulczar/spring-helloworld:latestc7140cecd5f7
tomcat-embed-core@9.0.16
9.0.31

Open the chart page →

5,596
seldon-core-oauth-gatewayseldon0.3.11 of 2See more

seldon-core-oauth-gateway seldon 0.3.1

1 of the 2 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
seldonio/apife:0.3.1eea0d3f578ca
tomcat-embed-core@8.5.34
8.5.51

Open the chart page →

8,098
shenyushenyu-helm-chart-test2.4.271 of 2See more

shenyu shenyu-helm-chart-test 2.4.27

1 of the 2 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
apache/shenyu-admin:2.4.2e8b7c4ddd069
tomcat-embed-core@9.0.29
9.0.31

Open the chart page →

12,513
umsappstacksimplifyVerified publisher1.0.01 of 3See more

umsapp stacksimplify 1.0.0

1 of the 3 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
ghcr.io/stacksimplify/kube-usermgmt-webapp:1.0.0-mysqldb41b45003c6b6
tomcat-embed-core@9.0.21
9.0.31

Open the chart page →

6,101
sonarqubestakaterVerified publisher0.10.31 of 2See more

sonarqube stakater 0.10.3

1 of the 2 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
library/sonarqube:6.7.6-community0ae5169e3d0f
tomcat-embed-core@8.5.23
8.5.51

Open the chart page →

11,841
streamastreama1.0.11 of 2See more

streama streama 1.0.1

1 of the 2 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
just1not2/streama:1.10.48a2305192dec
tomcat-embed-core@8.5.11
8.5.51

Open the chart page →

8,554
shenyutest-helm2.4.211 of 2See more

shenyu test-helm 2.4.21

1 of the 2 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
apache/shenyu-admin:2.4.2e8b7c4ddd069
tomcat-embed-core@9.0.29
9.0.31

Open the chart page →

12,513
drillwearefrank1.3.61 of 3See more

drill wearefrank 1.3.6

1 of the 3 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
apache/drill:1.21.11f96558fd292
tomcat-embed-core@8.5.46
8.5.51

Open the chart page →

9,397
sonarqubewebencryptor6.7.31 of 3See more

sonarqube webencryptor 6.7.3

1 of the 3 container images this version deploys carry CVE-2020-1938.

Container imageDigestPackageFixed in
library/sonarqube:8.2-communitya246bc64207e
tomcat-embed-core@8.5.41
8.5.51

Open the chart page →

5,460

Container images carrying it

33 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
apache/shenyu-admin:2.4.2e8b7c4ddd069
tomcat-embed-core@9.0.29
9.0.31
3
supertokens/supertokens-postgresql:3.1418d34c781347
tomcat-embed-core@8.5.47
8.5.51
3
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
tomcat-embed-core@8.5.31
8.5.51
2
scorpiobroker/scorpio:config-server_1.1.0c46c1517e523
tomcat-embed-core@9.0.26
9.0.31
2
apache/drill:1.21.11f96558fd292
tomcat-embed-core@8.5.46
8.5.51
1
apache/iotdb:0.11.28647309f95d1
tomcat-embed-core@8.5.32
8.5.51
1
apache/rocketmq:5.3.0434d8398f996
tomcat-embed-core@8.5.46
8.5.51
1
apache/rocketmq:4.9.35ac2a4e0f627
tomcat-embed-core@8.5.46
8.5.51
1
apacherocketmq/rocketmq-dashboard:1.0.024799aff6cf8
tomcat-embed-core@9.0.29
9.0.31
1
apache/skywalking-ui:8.1.067d50e4deff4
tomcat-embed-core@8.5.29
8.5.51
1
choerodon/event-store-service:0.8.03c94c97f6f69
tomcat-embed-core@8.5.14
8.5.51
1
dniel/forwardauth:latestf67129ea1c64
tomcat-embed-core@9.0.21
9.0.31
1
ibmcom/microclimate-file-watcher:latestab3fd1fdfa18
tomcat-embed-core@8.5.15
8.5.51
1
ibmcom/microclimate-theia:lateste17bdccc5030
tomcat-embed-core@8.5.15
8.5.51
1
jacobalberty/unifi:5.10.19c409924e2463
tomcat-embed-core@8.5.34
8.5.51
1
just1not2/streama:1.10.48a2305192dec
tomcat-embed-core@8.5.11
8.5.51
1
kimb88/hello-world-spring-boot:latest0639155241cb
tomcat-embed-core@8.5.32
8.5.51
1
ladeit/ladeit:latest962b665ffe82
tomcat-embed-core@9.0.13
9.0.31
1
library/sonarqube:6.7.6-community0ae5169e3d0f
tomcat-embed-core@8.5.23
8.5.51
1
library/sonarqube:8.2-communitya246bc64207e
tomcat-embed-core@8.5.41
8.5.51
1
microcks/microcks:0.8.0e3a3e0c67b09
tomcat-embed-core@8.5.34
8.5.51
1
omecproject/cdn-antmedia:1.0.0b4ae7d0d6b74
tomcat-embed-core@8.5.38
8.5.51
1
opencord/ves-agent:1.0.04187e2a8c918
tomcat-embed-core@8.5.31
8.5.51
1
opsmx11/issuegen:v2.1.05c50ca123d88
tomcat-embed-core@9.0.26
9.0.31
1
paulczar/spring-helloworld:latestc7140cecd5f7
tomcat-embed-core@9.0.16
9.0.31
1
richardchesterwood/k8s-fleetman-api-gateway:release2518f946b9f05
tomcat-embed-core@8.5.11
8.5.51
1
richardchesterwood/k8s-fleetman-position-tracker:release336c43961214c
tomcat-embed-core@8.5.4
8.5.51
1
sdandey/dandey-apps:kanban-board-kanban-appbef0f599737b
tomcat-embed-core@9.0.21
9.0.31
1
seldonio/apife:0.2.7ba81b17f00eb
tomcat-embed-core@8.5.34
8.5.51
1
seldonio/apife:0.3.1eea0d3f578ca
tomcat-embed-core@8.5.34
8.5.51
1
seldonio/cluster-manager:0.2.729e362bb1ba2
tomcat-embed-core@8.5.34
8.5.51
1
gcr.io/spinnaker-marketplace/halyard:1.32.00ee5f968d2ab
tomcat-embed-core@9.0.30
9.0.31
1
ghcr.io/stacksimplify/kube-usermgmt-webapp:1.0.0-mysqldb41b45003c6b6
tomcat-embed-core@9.0.21
9.0.31
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.