{"id":"CVE-2021-24122","published":"2021-01-14T14:45:18Z","modified":"2026-10-08T21:03:21Z","title":"Apache Tomcat information disclosure","vendor":"Apache","product":"Apache Tomcat","tier":"tail","description":{"text":"When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.22852,"percentile":0.97732,"provenance":"source"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"references":[{"url":"https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r776c64337495bf28b7d5597268114a888e3fad6045c40a0da0c66d4d%40%3Cdev.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2021/01/14/1","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r7e0bb9ea415724550e2b325e143b23e269579e54d66fcd7754bd0c20%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rb32a73b7cb919d4f44a2596b6b951274c0004fc8b0e393d6829a45f9%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r7382e1e35b9bc7c8f320b90ad77e74c13172d08034e20c18000fe710%40%3Cdev.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20210212-0008/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":19.5,"factors":[{"name":"EPSS percentile","points":19.55}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[">= Apache Tomcat 10, < 10.0.0-M10",">= Apache Tomcat 9, < 9.0.40",">= Apache Tomcat 8.5, < 8.5.60",">= Apache Tomcat 7, < 7.0.106"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=10.0.0-M1, <10.0.0-M10",">=9.0.0, <9.0.40",">=8.5.0, <8.5.60",">=7.0.0, <7.0.107"],"patched":["10.0.0-M10","9.0.40","8.5.60","7.0.107"],"from":["GHSA-2rvv-w9r2-rg7m"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-0906","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-tomcat-cve-2017-12615","parents":[{"from":"CVE-2017-12617","to":"CVE-2021-24122","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/catalina/webresources/AbstractFileResourceSet.java"],"commits":["https://github.com/apache/tomcat/commit/a9dd96046d7acb0357c6b7b9e6cc70d186fae663","https://github.com/apache/tomcat/commit/74ad0e216c791454a318c1811300469eedc5c6f3","https://github.com/apache/tomcat/commit/7f004ac4531c45f9a2a2d1470561fe135cf27bc2","https://github.com/apache/tomcat/commit/800b03140e640f8892f27021e681645e8e320177"],"basis":"shared function","functions":["file","isInvalidWindowsFilename"]}]}],"packageHistory":[{"cve":"CVE-2020-1938","published":"2020-02-24","fixed":"9.0.31","kev":true},{"cve":"CVE-2024-21733","published":"2024-01-19","fixed":"9.0.44","kev":false},{"cve":"CVE-2025-52434","published":"2025-07-10","fixed":"9.0.107","kev":false},{"cve":"CVE-2021-24122","published":"2021-01-14","fixed":"10.0.0-M10","kev":false},{"cve":"CVE-2020-11996","published":"2020-06-26","fixed":"10.0.0-M5","kev":false,"link":{"from":"CVE-2020-11996","to":"CVE-2021-24122","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"8.5.55","toFixed":"8.5.60","daysApart":202},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"9.0.35","toFixed":"9.0.40","daysApart":202}]}},{"cve":"CVE-2020-9484","published":"2020-05-20","fixed":"10.0.0-M5","kev":false,"link":{"from":"CVE-2020-9484","to":"CVE-2021-24122","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"7.0.104","toFixed":"7.0.107","daysApart":239}]}},{"cve":"CVE-2021-25122","published":"2021-03-01","fixed":"10.0.2","kev":false},{"cve":"CVE-2021-25329","published":"2021-03-01","fixed":"10.0.2","kev":false,"link":{"from":"CVE-2021-24122","to":"CVE-2021-25329","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"8.5.60","toFixed":"8.5.61","daysApart":46},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"9.0.40","toFixed":"9.0.41","daysApart":46}]}}],"package":"Maven:org.apache.tomcat.embed:tomcat-embed-core"}}