5.9

CVE-2021-24122

When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.

Data is provided by the National Vulnerability Database (NVD)
Apache ≫ Tomcat Version >= 7.0.0 <= 7.0.106
Apache ≫ Tomcat Version >= 8.5.0 <= 8.5.59
Apache ≫ Tomcat Version >= 9.0.1 <= 9.0.39
Apache ≫ Tomcat Version9.0.0 Updatemilestone1
Apache ≫ Tomcat Version9.0.0 Updatemilestone10
Apache ≫ Tomcat Version9.0.0 Updatemilestone11
Apache ≫ Tomcat Version9.0.0 Updatemilestone12
Apache ≫ Tomcat Version9.0.0 Updatemilestone13
Apache ≫ Tomcat Version9.0.0 Updatemilestone14
Apache ≫ Tomcat Version9.0.0 Updatemilestone15
Apache ≫ Tomcat Version9.0.0 Updatemilestone16
Apache ≫ Tomcat Version9.0.0 Updatemilestone17
Apache ≫ Tomcat Version9.0.0 Updatemilestone18
Apache ≫ Tomcat Version9.0.0 Updatemilestone19
Apache ≫ Tomcat Version9.0.0 Updatemilestone2
Apache ≫ Tomcat Version9.0.0 Updatemilestone20
Apache ≫ Tomcat Version9.0.0 Updatemilestone21
Apache ≫ Tomcat Version9.0.0 Updatemilestone22
Apache ≫ Tomcat Version9.0.0 Updatemilestone23
Apache ≫ Tomcat Version9.0.0 Updatemilestone24
Apache ≫ Tomcat Version9.0.0 Updatemilestone25
Apache ≫ Tomcat Version9.0.0 Updatemilestone26
Apache ≫ Tomcat Version9.0.0 Updatemilestone27
Apache ≫ Tomcat Version9.0.0 Updatemilestone3
Apache ≫ Tomcat Version9.0.0 Updatemilestone4
Apache ≫ Tomcat Version9.0.0 Updatemilestone5
Apache ≫ Tomcat Version9.0.0 Updatemilestone6
Apache ≫ Tomcat Version9.0.0 Updatemilestone7
Apache ≫ Tomcat Version9.0.0 Updatemilestone8
Apache ≫ Tomcat Version9.0.0 Updatemilestone9
Apache ≫ Tomcat Version10.0.0 Updatemilestone1
Apache ≫ Tomcat Version10.0.0 Updatemilestone2
Apache ≫ Tomcat Version10.0.0 Updatemilestone3
Apache ≫ Tomcat Version10.0.0 Updatemilestone4
Apache ≫ Tomcat Version10.0.0 Updatemilestone5
Apache ≫ Tomcat Version10.0.0 Updatemilestone6
Apache ≫ Tomcat Version10.0.0 Updatemilestone7
Apache ≫ Tomcat Version10.0.0 Updatemilestone8
Apache ≫ Tomcat Version10.0.0 Updatemilestone9
Debian ≫ Debian Linux Version9.0
Oracle ≫ Agile Plm Version9.3.3
Oracle ≫ Agile Plm Version9.3.6
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 57.13% 0.981
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.9 2.2 3.6
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CWE-706 Use of Incorrectly-Resolved Name or Reference

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.