csaf_redhat - rhsa-2025:7497

rhsa-2025:7497

Vulnerability from csaf_redhat

Published

2025-05-13 16:02

Modified

2025-08-03 13:23

Summary

Red Hat Security Advisory: tomcat security update

Notes

Topic

An update for tomcat is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API (CVE-2024-52316) * tomcat: Apache Tomcat: DoS in examples web application (CVE-2024-54677) * tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for tomcat is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API (CVE-2024-52316)\n\n* tomcat: Apache Tomcat: DoS in examples web application (CVE-2024-54677)\n\n* tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:7497",
        "url": "https://access.redhat.com/errata/RHSA-2025:7497"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2326972",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2326972"
      },
      {
        "category": "external",
        "summary": "2332815",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2332815"
      },
      {
        "category": "external",
        "summary": "2351129",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2351129"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7497.json"
      }
    ],
    "title": "Red Hat Security Advisory: tomcat security update",
    "tracking": {
      "current_release_date": "2025-08-03T13:23:35+00:00",
      "generator": {
        "date": "2025-08-03T13:23:35+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.6"
        }
      },
      "id": "RHSA-2025:7497",
      "initial_release_date": "2025-05-13T16:02:30+00:00",
      "revision_history": [
        {
          "date": "2025-05-13T16:02:30+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-05-13T16:02:30+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-08-03T13:23:35+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 10)",
                  "product_id": "AppStream-10.0.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:10.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat-1:10.1.36-1.el10_0.src",
                "product": {
                  "name": "tomcat-1:10.1.36-1.el10_0.src",
                  "product_id": "tomcat-1:10.1.36-1.el10_0.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat@10.1.36-1.el10_0?arch=src\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat-1:10.1.36-1.el10_0.noarch",
                "product": {
                  "name": "tomcat-1:10.1.36-1.el10_0.noarch",
                  "product_id": "tomcat-1:10.1.36-1.el10_0.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat@10.1.36-1.el10_0?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
                "product": {
                  "name": "tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
                  "product_id": "tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-admin-webapps@10.1.36-1.el10_0?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
                "product": {
                  "name": "tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
                  "product_id": "tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-docs-webapp@10.1.36-1.el10_0?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
                "product": {
                  "name": "tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
                  "product_id": "tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-el-5.0-api@10.1.36-1.el10_0?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
                "product": {
                  "name": "tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
                  "product_id": "tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-jsp-3.1-api@10.1.36-1.el10_0?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-lib-1:10.1.36-1.el10_0.noarch",
                "product": {
                  "name": "tomcat-lib-1:10.1.36-1.el10_0.noarch",
                  "product_id": "tomcat-lib-1:10.1.36-1.el10_0.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-lib@10.1.36-1.el10_0?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
                "product": {
                  "name": "tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
                  "product_id": "tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-servlet-6.0-api@10.1.36-1.el10_0?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-webapps-1:10.1.36-1.el10_0.noarch",
                "product": {
                  "name": "tomcat-webapps-1:10.1.36-1.el10_0.noarch",
                  "product_id": "tomcat-webapps-1:10.1.36-1.el10_0.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-webapps@10.1.36-1.el10_0?arch=noarch\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-1:10.1.36-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch"
        },
        "product_reference": "tomcat-1:10.1.36-1.el10_0.noarch",
        "relates_to_product_reference": "AppStream-10.0.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-1:10.1.36-1.el10_0.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src"
        },
        "product_reference": "tomcat-1:10.1.36-1.el10_0.src",
        "relates_to_product_reference": "AppStream-10.0.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch"
        },
        "product_reference": "tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
        "relates_to_product_reference": "AppStream-10.0.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch"
        },
        "product_reference": "tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
        "relates_to_product_reference": "AppStream-10.0.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch"
        },
        "product_reference": "tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
        "relates_to_product_reference": "AppStream-10.0.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch"
        },
        "product_reference": "tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
        "relates_to_product_reference": "AppStream-10.0.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-1:10.1.36-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch"
        },
        "product_reference": "tomcat-lib-1:10.1.36-1.el10_0.noarch",
        "relates_to_product_reference": "AppStream-10.0.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch"
        },
        "product_reference": "tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
        "relates_to_product_reference": "AppStream-10.0.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-1:10.1.36-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
          "product_id": "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
        },
        "product_reference": "tomcat-webapps-1:10.1.36-1.el10_0.noarch",
        "relates_to_product_reference": "AppStream-10.0.Z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-52316",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2024-11-18T12:00:54.223330+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2326972"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat when configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component. This vulnerability allows authentication bypass via improperly handled exceptions during the authentication process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has assessed this flaw at Attack Complexity as High, and impact metrics Confidentiality and Integrity as High, with a resultant base flaw Security Impact of Important. However, the factors involved in successful exploitation--usage of a custom Jakarta ServerAuthContext component, possible mishandling of exception management in that custom component, and failure in such a way as to allow a failed authentication to proceed in that exception mishandling--are sufficiently unlikely, such that Apache determined the impact to be Low. While Red Hat concurs with the worst-case assessment of Important for the base flaw, all products are assessed as Low, per individual risk assessment and in concurrence with Apache\u0027s rating.\n\nRed Hat Satellite is not directly impacted by this issue as it does not include the affected Tomcat package. However, Tomcat is consumed by Candlepin, a component of Satellite. Red Hat Satellite users are advised to check the impact state of Red Hat Enterprise Linux as any necessary fixes will be distributed through the platform.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
          "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
          "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
          "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
          "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
          "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
          "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
          "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
          "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-52316"
        },
        {
          "category": "external",
          "summary": "RHBZ#2326972",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2326972"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-52316",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-52316"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-52316",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52316"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928",
          "url": "https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928"
        }
      ],
      "release_date": "2024-11-18T11:32:22.072000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T16:02:30+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
            "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7497"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
            "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API"
    },
    {
      "cve": "CVE-2024-54677",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2024-12-17T13:00:41.984822+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2332815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the \"examples\" web application of Apache Tomcat. Numerous examples within that application did not place limits on uploaded data. This vulnerability can potentially trigger an out-of-memory (OOM) error, leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat: DoS in examples web application",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "By default, the examples web application is only accessible to the localhost.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
          "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
          "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
          "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
          "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
          "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
          "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
          "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
          "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-54677"
        },
        {
          "category": "external",
          "summary": "RHBZ#2332815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2332815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-54677",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-54677"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-54677",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54677"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n",
          "url": "https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n"
        }
      ],
      "release_date": "2024-12-17T12:35:50.948000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T16:02:30+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
            "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7497"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
            "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat: Apache Tomcat: DoS in examples web application"
    },
    {
      "cve": "CVE-2025-24813",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2025-03-10T17:00:47.696071+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2351129"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Tomcat. In certain conditions and configurations, this vulnerability allows a remote attacker to exploit a path equivalence flaw to view file system contents and add malicious content via a write-enabled\u00a0Default Servlet\u00a0in Apache Tomcat. \n\nFor the vulnerability to be exploited, the following conditions must be true: writes to the default servlet are enabled (disabled by default), sensitive file uploads are sub-directories of a target URL for public uploads, attackers know the names of the files, and those files are subject to partial PUT uploads enabled by default. If an application uses file-based session persistence with default storage and includes exploitable libraries, remote code execution (RCE) is possible.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability has a Moderate impact (rather than Important) because it requires multiple non-default configurations to be exploitable, significantly limiting its impact in typical deployments. For remote code execution (RCE), exploitation requires both file-based session persistence and a library vulnerable to deserialization, further reducing its likelihood. For information disclosure or file injection, the attack is only possible if writes are enabled for the default servlet, partial PUT requests are supported, and sensitive file uploads occur within a publicly writable directory. The combination of all three of these conditions is uncommon in secure environments. Since most modern Tomcat deployments do not meet all these criteria simultaneously, the overall risk is reduced\n\nThe Tomcat package as shipped in Red Hat Enterprise Linux 6 and 7 is not affected by this vulnerability because the vulnerable code was introduced in a newer Tomcat version.\n\nRed Hat Satellite is not directly impacted by this issue as it does not include the affected Tomcat package. However, Tomcat is consumed by Candlepin, a component of Satellite. Red Hat Satellite users are advised to check the impact state of Red Hat Enterprise Linux as any necessary fixes will be distributed through the platform. Satellite configuration does not contain affected parameters that would make Tomcat vulnerable, therefore, even if a vulnerable Tomcat version is shipped with affected RHEL release alongside Satellite, there is no chance of it being exposed to flaw in Red Hat Satellite.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
          "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
          "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
          "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
          "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
          "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
          "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
          "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
          "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-24813"
        },
        {
          "category": "external",
          "summary": "RHBZ#2351129",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2351129"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-24813",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-24813"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-24813",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24813"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq",
          "url": "https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2025-03-10T16:44:03.715000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T16:02:30+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
            "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7497"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
            "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
            "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
            "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2025-04-01T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT"
    }
  ]
}

CVE-2024-54677 (GCVE-0-2024-54677)

Vulnerability from cvelistv5

Published

2024-12-17 12:35

Modified

2025-08-08 11:22

Severity ?

CWE

CWE-400 - Uncontrolled Resource Consumption

Summary

Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.

References

►

URL

Tags

https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n

vendor-advisory

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Tomcat	Version: 11.0.0-M1 ≤ 11.0.1 Version: 10.1.0-M1 ≤ 10.1.33 Version: 9.0.0.M1 ≤ 9.0.97 Version: 8.5.0 ≤ 8.5.100

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-54677",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-17T16:41:40.093839Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-17T16:45:33.335Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-01-31T15:02:50.435Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/12/17/5"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/12/17/6"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/12/18/1"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20250131-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.1",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.33",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.97",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.0",
              "status": "unknown",
              "version": "3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97.\u003cbr\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-08T11:22:57.924Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Tomcat: DoS in examples web application",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-54677",
    "datePublished": "2024-12-17T12:35:50.948Z",
    "dateReserved": "2024-12-05T07:31:33.851Z",
    "dateUpdated": "2025-08-08T11:22:57.924Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-24813 (GCVE-0-2025-24813)

Vulnerability from cvelistv5

Published

2025-03-10 16:44

Modified

2025-08-08 11:39

Severity ?

CWE

CWE-44 - Path Equivalence: 'file.name' (Internal Dot)
CWE-502 - Deserialization of Untrusted Data

Summary

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

References

►

URL

Tags

https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq

vendor-advisory

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Tomcat	Version: 11.0.0-M1 ≤ 11.0.2 Version: 10.1.0-M1 ≤ 10.1.34 Version: 9.0.0.M1 ≤ 9.0.98 Version: 8.5.0 ≤ 8.5.100

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-07-21T17:13:17.168Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/03/10/5"
          },
          {
            "url": "https://www.vicarius.io/vsociety/posts/cve-2025-24813-detect-apache-tomcat-rce"
          },
          {
            "url": "https://www.vicarius.io/vsociety/posts/cve-2025-24813-mitigate-apache-tomcat-rce"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20250321-0001/"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00003.html"
          },
          {
            "url": "https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-detect-vulnerability"
          },
          {
            "url": "https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-mitigation-vulnerability"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-24813",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-01T19:37:06.207441Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-04-01",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24813"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-30T01:36:18.299Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/absholi7ly/POC-CVE-2025-24813/blob/main/README.md"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2025-04-01T00:00:00+00:00",
            "value": "CVE-2025-24813 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.2",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.34",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.98",
              "status": "affected",
              "version": "9.0.0.M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.0",
              "status": "unknown",
              "version": "3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "COSCO Shipping Lines DIC"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "sw0rd1ight (https://github.com/sw0rd1ight)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ePath Equivalence: \u0027file.Name\u0027 (Internal Dot) leading to\u0026nbsp;\u003cspan style=\"background-color: var(--wht);\"\u003eRemote Code Execution and/or Information disclosure\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eand/or malicious content added to uploaded files via write enabled\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eDefault Servlet\u003c/span\u003e\u0026nbsp;in Apache Tomcat.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\u003cbr\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\u003cbr\u003e\u003c/p\u003e\u003cdiv\u003e\u003cp\u003eIf all of the following were true, a malicious user was able to view       security sensitive files and/or inject content into those files:\u003cbr\u003e-\u0026nbsp;\u003cspan style=\"background-color: var(--wht);\"\u003ewrites enabled for the default servlet (disabled by default)\u003cbr\u003e\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003e- support for partial PUT (enabled by default)\u003cbr\u003e\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003e- a target URL for security sensitive uploads that was a sub-directory of\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003ea target URL for public uploads\u003cbr\u003e-\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eattacker knowledge of the names of security sensitive files being\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003euploaded\u003cbr\u003e-\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003ethe security sensitive files also being uploaded via partial PUT\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eIf all of the following were true, a malicious user was able to\u003c/span\u003e       perform remote code execution:\u003cbr\u003e\u003cspan style=\"background-color: var(--wht);\"\u003e- writes enabled for the default servlet (disabled by default)\u003cbr\u003e-\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003esupport for partial PUT (enabled by default)\u003cbr\u003e-\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eapplication was using Tomcat\u0027s file based session persistence with the\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003edefault storage location\u003cbr\u003e-\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eapplication included a library that may be leveraged in a\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003edeserialization attack\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e"
            }
          ],
          "value": "Path Equivalence: \u0027file.Name\u0027 (Internal Dot) leading to\u00a0Remote Code Execution and/or Information disclosure\u00a0and/or malicious content added to uploaded files via write enabled\u00a0Default Servlet\u00a0in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nIf all of the following were true, a malicious user was able to view       security sensitive files and/or inject content into those files:\n-\u00a0writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of\u00a0a target URL for public uploads\n-\u00a0attacker knowledge of the names of security sensitive files being\u00a0uploaded\n-\u00a0the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to       perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n-\u00a0support for partial PUT (enabled by default)\n-\u00a0application was using Tomcat\u0027s file based session persistence with the\u00a0default storage location\n-\u00a0application included a library that may be leveraged in a\u00a0deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-44",
              "description": "CWE-44 Path Equivalence: \u0027file.name\u0027 (Internal Dot)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-08T11:39:52.257Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-24813",
    "datePublished": "2025-03-10T16:44:03.715Z",
    "dateReserved": "2025-01-24T08:51:50.296Z",
    "dateUpdated": "2025-08-08T11:39:52.257Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-52316 (GCVE-0-2024-52316)

Vulnerability from cvelistv5

Published

2024-11-18 11:32

Modified

2025-08-13 13:30

Severity ?

CWE

CWE-391 - Unchecked Error Condition

Summary

Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.

References

►

URL

Tags

https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928

vendor-advisory

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Tomcat	Version: 11.0.0-M1 ≤ 11.0.0-M26 Version: 10.1.0-M1 ≤ 10.1.30 Version: 9.0.0-M1 ≤ 9.0.95 Version: 8.5.0 ≤ 8.5.100

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apache:tomcat:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "tomcat",
            "vendor": "apache",
            "versions": [
              {
                "lessThanOrEqual": "9.0.95",
                "status": "affected",
                "version": "9.0.0-M1",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "10.1.30",
                "status": "affected",
                "version": "10.1.0-M1",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "11.0.0-M26",
                "status": "affected",
                "version": "11.0.0-M1",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-52316",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-18T14:50:59.890424Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-13T13:30:10.255Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-01-24T20:03:09.111Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/11/18/2"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20250124-0003/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Tomcat",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "11.0.0-M26",
              "status": "affected",
              "version": "11.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.30",
              "status": "affected",
              "version": "10.1.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.0.95",
              "status": "affected",
              "version": "9.0.0-M1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.5.100",
              "status": "affected",
              "version": "8.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUnchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC)\u0026nbsp;ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta\u0026nbsp;Authentication components that behave in this way.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95.\u003c/p\u003e\u003cp\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC)\u00a0ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta\u00a0Authentication components that behave in this way.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100.\n\n\nUsers are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-391",
              "description": "CWE-391 Unchecked Error Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-08T11:20:48.868Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Apache Tomcat: Authentication bypass when using Jakarta Authentication API",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-52316",
    "datePublished": "2024-11-18T11:32:22.072Z",
    "dateReserved": "2024-11-07T07:41:56.639Z",
    "dateUpdated": "2025-08-13T13:30:10.255Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

rhsa-2025:7497

Vulnerability from csaf_redhat

CVE-2024-54677 (GCVE-0-2024-54677)

Vulnerability from cvelistv5

CVE-2025-24813 (GCVE-0-2025-24813)

Vulnerability from cvelistv5

CVE-2024-52316 (GCVE-0-2024-52316)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature