{"id":"CVE-2024-50379","published":"2024-12-17T12:34:54Z","modified":"2025-11-03T20:45:15Z","title":"Apache Tomcat: RCE due to TOCTOU issue in JSP compilation","vendor":"Apache","product":"Apache Tomcat","tier":"tail","description":{"text":"Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.31824,"percentile":0.98294,"provenance":"source"},"cwes":[{"id":"CWE-367","name":"Time-of-check Time-of-use (TOCTOU) Race Condition"}],"references":[{"url":"https://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/12/17/4","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2024/12/18/2","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20250103-0003/","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html","tags":[]}],"priority":{"score":31.5,"factors":[{"name":"EPSS percentile","points":19.66},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":6.86}]},"exploitSources":{"pocGithub":{"count":14,"skipped":1,"earliest":"2024-12-18","earliestUrl":"https://github.com/v3153/CVE-2024-50379-POC","repos":[{"name":"SleepingBag945/CVE-2024-50379","url":"https://github.com/SleepingBag945/CVE-2024-50379","stars":84,"created":"2024-12-23"},{"name":"ph0ebus/Tomcat-CVE-2024-50379-Poc","url":"https://github.com/ph0ebus/Tomcat-CVE-2024-50379-Poc","stars":57,"created":"2024-12-21"},{"name":"iSee857/CVE-2024-50379-PoC","url":"https://github.com/iSee857/CVE-2024-50379-PoC","stars":24,"created":"2024-12-20"},{"name":"v3153/CVE-2024-50379-POC","url":"https://github.com/v3153/CVE-2024-50379-POC","stars":4,"created":"2024-12-18"},{"name":"dragonked2/CVE-2024-50379-POC","url":"https://github.com/dragonked2/CVE-2024-50379-POC","stars":4,"created":"2024-12-25"}]},"first":{"date":"2024-12-18","source":"PoC-in-GitHub","url":"https://github.com/v3153/CVE-2024-50379-POC"},"provenance":"source"},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[">= 11.0.0-M1, <= 11.0.1",">= 10.1.0-M1, <= 10.1.33",">= 9.0.0.M1, <= 9.0.97",">= 8.5.0, <= 8.5.100"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","vulnerableRanges":[">=11.0.0-M1, <11.0.2",">=10.1.0-M1, <10.1.34",">=9.0.0.M1, <9.0.98",">=8.5.0, <=8.5.100"],"patched":["11.0.2","10.1.34","9.0.98"],"from":["GHSA-5j33-cvvr-w245"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=11.0.0-M1, <11.0.2",">=10.1.0-M1, <10.1.34",">=9.0.0.M1, <9.0.98",">=8.5.0, <=8.5.100"],"patched":["11.0.2","10.1.34","9.0.98"],"from":["GHSA-5j33-cvvr-w245"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-3537","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-tomcat-cve-2024-50379","children":[{"from":"CVE-2024-50379","to":"CVE-2024-56337","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"The mitigation for CVE-2024-50379 was incomplete.","from":"CVE.org","in":"CVE-2024-56337"},{"kind":"osv-related","provenance":"source","id":"GHSA-27hp-xhwr-wr2m","via":"reference","url":"https://www.cve.org/CVERecord?id=CVE-2024-50379"},{"kind":"similar","provenance":"machine","score":0.45,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2023-28708","published":"2023-03-22","fixed":"11.0.0-M3","kev":false},{"cve":"CVE-2023-24998","published":"2023-02-20","fixed":"11.0.0-M5","kev":false},{"cve":"CVE-2024-52316","published":"2024-11-18","fixed":"11.0.1","kev":false,"link":{"from":"CVE-2024-52316","to":"CVE-2024-50379","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-catalina","fromFixed":"10.1.30","toFixed":"10.1.34","daysApart":29},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-catalina","fromFixed":"11.0.1","toFixed":"11.0.2","daysApart":29},{"kind":"similar","provenance":"machine","score":0.29,"basis":"same product + description similarity"}]}},{"cve":"CVE-2024-50379","published":"2024-12-17","fixed":"11.0.2","kev":false},{"cve":"CVE-2024-56337","published":"2024-12-20","fixed":"11.0.2","kev":false},{"cve":"CVE-2025-24813","published":"2025-03-10","fixed":"11.0.3","kev":true,"link":{"from":"CVE-2024-50379","to":"CVE-2025-24813","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-catalina","fromFixed":"9.0.98","toFixed":"9.0.99","daysApart":83}]}},{"cve":"CVE-2025-31651","published":"2025-04-28","fixed":"11.0.6","kev":false}],"package":"Maven:org.apache.tomcat:tomcat-catalina"}}