Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (Apache Software Foundation Apache Tomcat)
En bref
- Source
- NVD
- EPSS
- EPSS 99.94 % · centile 100 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- apache
- Statut NVD
- Analyzed
Description
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.
Faiblesses (CWE)
- CWE-44 — Path Equivalence: 'file.name' (Internal Dot)
- CWE-502 — Désérialisation de données non fiables
- CWE-706 — Use of Incorrectly-Resolved Name or Reference
Références
- https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq
- http://www.openwall.com/lists/oss-security/2025/03/10/5
- https://www.vicarius.io/vsociety/posts/cve-2025-24813-detect-apache-tomcat-rce
- https://www.vicarius.io/vsociety/posts/cve-2025-24813-mitigate-apache-tomcat-rce
- https://security.netapp.com/advisory/ntap-20250321-0001/
- https://lists.debian.org/debian-lts-announce/2025/04/msg00003.html
- https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-detect-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-mitigation-vulnerability
- https://github.com/absholi7ly/POC-CVE-2025-24813/blob/main/README.md
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24813
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | CRITICAL 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Avis
- GHSA-83qj-6fr2-vhqg — Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Références européennes
- ENISA EUVD · EUVD-2025-6498
- GCVE · GCVE-0-2025-24813
Avis du CERT-FR
- CERTFR-2026-AVI-0395 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0281 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0969 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0756 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0541 — Vulnérabilité dans Centreon Map · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0401 — Multiples vulnérabilités dans Juniper Networks Secure Analytics · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0370 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0240 — Vulnérabilité dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0200 — Vulnérabilité dans Apache Tomcat · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*< 9.0.99cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 10.1.1 < 10.1.35cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 11.0.1 < 11.0.3cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone17:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone18:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone19:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone20:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone12:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone13:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone14:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone15:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone16:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone17:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone18:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone19:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone21:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone22:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:*- +10 autres
Produits affectés
| Produit | Versions |
|---|---|
| Apache Software Foundation · Apache Tomcat | affected 11.0.0-M1 ≤ 11.0.2 ; affected 10.1.0-M1 ≤ 10.1.34 ; affected 9.0.0.M1 ≤ 9.0.98 ; affected 8.5.0 ≤ 8.5.100 ; unknown 3 < 8.5.0 ; unknown 10.0.0-M1 ≤ 10.0.27 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |