CVE-2021-25329

Aliases:GHSA-jgwr-3qm3-26f3BIT-tomcat-2021-25329
Advisory lineage Upstream: 0 Downstream: 18
Modified
Published: 01 Mar 2021, 12:00
Last modified:13 Feb 2025, 16:27

Vulnerability Summary

Overall Risk (default)
medium
28/100
CVSS Score
7 HIGH
v3.1 (nvd)
EPSS Score
0.8% LOW
1% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

01 Mar 2021, 12:00
Published
Vulnerability first disclosed
13 Feb 2025, 16:27
Last Modified
Vulnerability information updated

Description

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.

CVSS Metrics

  • v3.1•HIGH•Score: 7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • v2.0•MEDIUM•Score: 4.4AV:L/AC:M/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 0.80%• Percentile: 74%

Affected Systems

  • apache software foundation•apache tomcat

    ≥ Apache Tomcat 10, < 10.0.0 | ≥ Apache Tomcat 9, < 9.0.41 | ≥ Apache Tomcat 8.5, < 8.5.61 | ≥ Apache Tomcat 7, < 7.0.107

  • Unknown•Tomcat

    ≥ 7.0.0, ≤ 7.0.107 | ≥ 8.5.0, ≤ 8.5.61 | ≥ 9.0.0, ≤ 9.0.41 | 9.0.0:milestone1 | 9.0.0:milestone10 | 9.0.0:milestone11 | 9.0.0:milestone12 | 9.0.0:milestone13 | 9.0.0:milestone14 | 9.0.0:milestone15 | 9.0.0:milestone16 | 9.0.0:milestone17 | 9.0.0:milestone18 | 9.0.0:milestone19 | 9.0.0:milestone2 | 9.0.0:milestone20 | 9.0.0:milestone21 | 9.0.0:milestone22 | 9.0.0:milestone23 | 9.0.0:milestone24 | 9.0.0:milestone25 | 9.0.0:milestone26 | 9.0.0:milestone27 | 9.0.0:milestone3 | 9.0.0:milestone4 | 9.0.0:milestone5 | 9.0.0:milestone6 | 9.0.0:milestone7 | 9.0.0:milestone8 | 9.0.0:milestone9 | 10.0.0 | 10.0.0:milestone1 | 10.0.0:milestone10 | 10.0.0:milestone2 | 10.0.0:milestone3 | 10.0.0:milestone4 | 10.0.0:milestone5 | 10.0.0:milestone6 | 10.0.0:milestone7 | 10.0.0:milestone8 | 10.0.0:milestone9

  • debian•debian_linux

    9.0 | 10.0

  • org.apache.tomcat.embed•tomcat-embed-core

    ≥ 10.0.0-M1, < 10.0.2 | ≥ 9.0.0, < 9.0.41 | ≥ 8.0.0, < 8.5.61 | ≥ 7.0.0, < 7.0.108

  • oracle•agile_plm

    9.3.3 | 9.3.6

  • oracle•communications_cloud_native_core_policy

    1.14.0

  • oracle•communications_cloud_native_core_security_edge_protection_proxy

    1.6.0

  • oracle•communications_instant_messaging_server

    10.0.1.5.0

  • oracle•database

    12.2.0.1 | 19c | 21c

  • oracle•graph_server_and_client

    < 21.3.0

  • oracle•instantis_enterprisetrack

    17.1 | 17.2 | 17.3

  • oracle•managed_file_transfer

    12.2.1.3.0 | 12.2.1.4.0

  • oracle•mysql_enterprise_monitor

    ≤ 8.0.23

  • oracle•siebel_ui_framework

    < 21.9 | 21.9

References (30)