CVE-2024-50379

Aliases:GHSA-5j33-cvvr-w245BIT-tomcat-2024-50379
Advisory lineage Upstream: 0 Downstream: 20
Modified
Published: 17 Dec 2024, 12:34
Last modified:03 Nov 2025, 20:45

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (cve.org)
EPSS Score
84.78% CRITICAL
85% probability -3.81%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

17 Dec 2024, 12:34
Published
Vulnerability first disclosed
03 Nov 2025, 20:45
Last Modified
Vulnerability information updated

Description

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.

CVSS Metrics

  • v4.0•CRITICAL•Score: 9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 84.78%• Percentile: 99%

Techniques & Countermeasures

  • CWE-367•Time-of-check Time-of-use (TOCTOU) Race Condition

    The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Affected Systems

  • apache software foundation•apache tomcat

    ≥ 11.0.0-M1, ≤ 11.0.1 | ≥ 10.1.0-M1, ≤ 10.1.33 | ≥ 9.0.0.M1, ≤ 9.0.97 | ≥ 8.5.0, ≤ 8.5.100

  • Unknown•Tomcat

    ≥ 9.0.0, < 9.0.98 | ≥ 10.1.0, < 10.1.34 | ≥ 11.0.0, < 11.0.2

  • org.apache.tomcat•tomcat-catalina

    ≥ 11.0.0-M1, < 11.0.2 | ≥ 10.1.0-M1, < 10.1.34 | ≥ 9.0.0.M1, < 9.0.98 | ≥ 8.5.0, ≤ 8.5.100

  • org.apache.tomcat.embed•tomcat-embed-core

    ≥ 11.0.0-M1, < 11.0.2 | ≥ 10.1.0-M1, < 10.1.34 | ≥ 9.0.0.M1, < 9.0.98 | ≥ 8.5.0, ≤ 8.5.100

  • netapp•bootstrap_os

    na

References (17)