Test ID:	1.3.6.1.4.1.25623.1.0.114890
Category:	Web Servers
Title:	Apache Tomcat Multiple Vulnerabilities (Dec 2024) - Windows
Summary:	Apache Tomcat is prone to multiple vulnerabilities.
Description:	Summary: Apache Tomcat is prone to multiple vulnerabilities. Vulnerability Insight: The following flaws exist: - CVE-2024-50379: Remote code execution (RCE) via write-enabled default servlet - CVE-2024-54677: Denial of service (DoS) in examples web application - CVE-2024-56337: RCE via write-enabled default servlet - CVE-2024-50379 mitigation was incomplete Affected Software/OS: Apache Tomcat versions prior to 9.0.98, 10.x prior to 10.1.34 and 11.x prior to 11.0.2. Note: While not explicitly mentioned by the vendor (due to the EOL status of these branches) it is assumed that the whole 10.x branch and all versions prior to 9.x are affected by these flaws. If you disagree with this assessment and want to accept the risk please create an override for this result. Solution: Update to version 9.0.98, 10.1.34, 11.0.2 or later. Vendor note: Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2024-50379 Common Vulnerability Exposure (CVE) ID: CVE-2024-54677 Common Vulnerability Exposure (CVE) ID: CVE-2024-56337
Copyright	Copyright (C) 2024 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.