CVE-2024-50379
Apache Tomcat TOCTOU Race Condition RCE on Case Insensitive File Systems
Description
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
INFO
Published Date :
Dec. 17, 2024, 1:15 p.m.
Last Modified :
July 1, 2025, 8:30 p.m.
Source :
[email protected]
Remotely Exploitable :
Yes !
Impact Score :
5.9
Exploitability Score :
3.9
Public PoC/Exploit Available at Github
CVE-2024-50379 has a 45 public PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
Affected Products
The following products are affected by CVE-2024-50379
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-50379.
| URL | Resource |
|---|---|
| https://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r | Mailing List Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2024/12/17/4 | Mailing List |
| http://www.openwall.com/lists/oss-security/2024/12/18/2 | Mailing List |
| https://security.netapp.com/advisory/ntap-20250103-0003/ | Third Party Advisory |
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
备份的漏洞库，3月开始我们来维护
None
None
None
cve-2024-50379
Python
Cve exploiting
cve-2024 cve-2024-50379 cve-poc
Python
CVE POC repo 자동 수집기
Python
None
Guida alla soluzione delle CTF
Smith: It's a security Agent Written with Scala 3.x
Scala Shell
None
HTML
None
Python
wy876
Python
None
Python
None
Dockerfile JavaScript Shell
wy876 POC | wy876的poc仓库已删库，该项目为其仓库镜像
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-50379 vulnerability anywhere in the article.
-
BleepingComputer
Brute-force attacks target Apache Tomcat management panels
A coordinated campaign of brute-force attacks using hundreds of unique IP addresses targets Apache Tomcat Manager interfaces exposed online. Tomcat is a popular open-source web server widely used by l ... Read more
-
The Register
Rather than add a backdoor, Apple decides to kill iCloud E2EE for UK peeps
Infosec in brief Apple has responded to the UK government's demand for access to its customers’ data stored in iCloud by deciding to turn off its Advanced Data Protection (ADP) end-to-end encryption s ... Read more
-
security.nl
Atlassian waarschuwt voor kritieke Tomcat-kwetsbaarheden in Confluence
Softwarebedrijf Atlassian waarschuwt voor twee kritieke kwetsbaarheden in Confluence Data Center en Server waardoor remote code execution mogelijk is. De impact van de twee kwetsbaarheden (CVE-2024-50 ... Read more
-
TheCyberThrone
CVE-2025-24480 impacts Rockwell Automation
CVE-2025-24480 is a critical vulnerability that has been identified in FactoryTalk View Machine Edition, a widely used industrial automation software from Rockwell Automation. This vulnerability is pa ... Read more
-
TheCyberThrone
TheCyberThrone CyberSecurity Newsletter Top 5 Articles – January 2025
Welcome to TheCyberThrone cybersecurity month in review will be posted covering the important security happenings . This review is for the month ending January 2025Subscribers favorite #1Exploit Code ... Read more
-
TheCyberThrone
CVE-2024-53299 impacts Apache Wicket
BackgroundCVE-2024-53299 is a significant security vulnerability identified in Apache Wicket, specifically impacting versions prior to 9.19.0 and 10.3.0. This vulnerability allows attackers to initiat ... Read more
-
TheCyberThrone
TheCyberThrone Security BiWeekly Review – January 25, 2025
Welcome to TheCyberThrone. Cybersecurity week in review will be posted covering the important security happenings. This review is for the bi-weekly ending on Saturday, January 25, 2025.CVE-2025-0411 i ... Read more
-
TheCyberThrone
CVE-2024-53691: PoC Exploit Code Release for QNAP Flaw
CVE-2024-53691 is a severe remote code execution (RCE) vulnerability discovered in QNAP NAS devices. Recently, security researcher c411e released a Proof-of-Concept (PoC) exploit code, underscoring th ... Read more
-
TheCyberThrone
CVE-2025-0107 PoC Exploit Code Released for PaloAlto Flaw
Background:CVE-2025-0107 is a critical OS command injection vulnerability discovered in Palo Alto Networks’ Expedition Tool, version 1.2.101 and earlier. Recently, security researchers released a Proo ... Read more
-
TheCyberThrone
CVE-2024-44243: macOS SIP Bypass Flaw
CVE-2024-44243 is a critical vulnerability discovered in macOS that allows attackers to bypass Apple’s System Integrity Protection (SIP) by exploiting third-party kernel extensions. This vulnerability ... Read more
-
TheCyberThrone
CISA adds Fortinet flaw CVE-2024-55591 to KEV Catalog
CVE-2024-55591 is a critical vulnerability affecting Fortinet’s FortiOS and FortiProxy devices. This vulnerability allows a remote attacker to bypass authentication mechanisms and gain super-admin pri ... Read more
-
TheCyberThrone
CVE-2024-5594 impacts OpenVPN
CVE-2024-5594 is a critical vulnerability identified in OpenVPN versions prior to 2.6.11. This vulnerability stems from improper sanitization of PUSH_REPLY messages, which allows attackers to inject u ... Read more
-
TheCyberThrone
CVE-2024-53704 impacts SonicWall
CVE-2024-53704 is a high-severity vulnerability impacting SonicWall’s SSLVPN authentication mechanism. This flaw, with a CVSS score of 8.2, allows remote attackers to bypass authentication and gain un ... Read more
-
TheCyberThrone
CISA KEV UPDATE Part I – January 2025
The US CISA has added 3 vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on the evidence of active exploitation.CVE-2024-41713: Mitel MiCollab Path Traversal VulnerabilityDe ... Read more
-
TheCyberThrone
TheCyberThrone Security Biweekly Review – December 28, 2024
Welcome to TheCyberThrone cybersecurity week in review will be posted covering the important security happenings. This review is for the biweekly ending Saturday, December 28, 2024.Indian users are ta ... Read more
-
TheCyberThrone
CVE-2024-45387 Critical Bug in Apache Traffic Control
CVE-2024-45387 represents a significant security concern within the Traffic Ops component of Apache Traffic Control, specifically impacting versionsThe heart of this vulnerability is an SQL injection ... Read more
-
TheCyberThrone
Microsoft Patch Tuesday Year 2024 Analysis
In 2024, Microsoft’s Patch Tuesday updates played a critical role in addressing security vulnerabilities across various platforms. Throughout the year, a total of 1,000+ vulnerabilities were patched, ... Read more
-
TheCyberThrone
Zeroday Vulnerabilities Prevailed in 2024 Analysis-Part II
This is the continuation of Zeroday vulnerabilities in 2024. Let’s delve deeply into the continuation of zero-day vulnerabilities of 2024, providing a comprehensive analysis.1. CVE-2023-46805: Authen ... Read more
-
TheCyberThrone
CISA adds Acclaim Flaw CVE-2021-44207 to KEV Catalog
The US CISA has added new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitationCVE-2021-44207: Acclaim Systems USAHERDS Use of Hard-Coded Credentials V ... Read more
-
security.nl
Kritiek lek in Apache Tomcat maakt remote code execution mogelijk
Een kritieke kwetsbaarheid in Apache Tomcat maakt remote code execution mogelijk. De Apache Foundation kwam vorige week met een beveiligingsupdate, maar die bleek het probleem niet volledig te verhelp ... Read more
-
BleepingComputer
Apache fixes remote code execution bypass in Tomcat web server
Apache has released a security update that addresses an important vulnerability in Tomcat web server that could lead to an attacker achieving remote code execution. Apache Tomcat is an open-source web ... Read more
-
TheCyberThrone
BeyondTrust SaaS Breach Comprehensive Breakdown
Incident DiscoveryOn December 2, 2024, BeyondTrust identified a significant security breach during a forensics investigation. This discovery set off a series of urgent actions to mitigate the impact a ... Read more
-
Cybersecurity News
CVE-2024-56337: Apache Tomcat Patches Critical RCE Vulnerability
The Apache Software Foundation recently released a critical security update to address a remote code execution (RCE) vulnerability in Apache Tomcat, identified as CVE-2024-56337. This vulnerability af ... Read more
-
TheCyberThrone
Detailing Databricks Vulnerability CVE-2024-49194
A critical vulnerability has been identified that affects the Databricks JDBC Driver. This vulnerability allows for remote code execution (RCE) through a JNDI injection exploit using a malicious JDBC ... Read more
-
TheCyberThrone
Sophos fixes Triple Critical Vulnerabilities in its Firewall
Sophos released patches for three critical security vulnerabilities in their widely-used network security tool, Sophos Firewall that posed significant risks, including remote code execution and privil ... Read more
-
TheCyberThrone
CISA adds BeyondTrust CVE-2024-12356 to its KEV Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.CVE-2024-12356: Command Injection Vulnerability in BeyondTrust PRA and RSO ... Read more
-
TheCyberThrone
Fortinet fixes several vulnerabilities including CVE-2023-34990
Fortinet has released patches for vulnerabilities affecting its popular products, including FortiClient VPN, FortiManager, and FortiWLM. These flaws range from password exposure to remote code executi ... Read more
-
TheCyberThrone
Clop ransomware exploits Cleo Vulnerability in its attacks
The Clop ransomware gang has recently claimed responsibility for a series of sophisticated data theft attacks targeting Cleo, a prominent provider of managed file transfer software. These attacks expl ... Read more
-
TheCyberThrone
TheCyberThrone Security BiWeekly Review – December 14, 2024
Welcome to TheCyberThrone cybersecurity week in review will be posted covering the important security happenings. This review is for the weeks ending Saturday, November 30, 2024.Jenkins fixes multiple ... Read more
-
TheCyberThrone
CISA adds Cleo Vulnerability CVE-2024-50623 to KEV Catalog
The US CISA adds Cleo vulnerability to its Known Exploited Vulnerabilities Catalog based on the evidence of active exploitation reported.Security vendor Huntress was the first to publicize the attacks ... Read more
-
TheCyberThrone
Gitlab fixes CVE-2024-11274 and CVE-2024-8233
GitLab has released a crucial security update to address multiple vulnerabilities impacting various versions of its platform. This update, applicable to versions 17.6.2, 17.5.4, and 17.4.6 for both Co ... Read more
-
TheCyberThrone
Apache Struts was affected by CVE-2024-53677
Apache Struts framework has been detected with a critical vulnerability that could allow attackers to execute malicious code remotely, posing a significant risk to affected systems.The vulnerability t ... Read more
-
TheCyberThrone
Splunk addresses CVE-2024-53247 in Secure Gateway
A critical vulnerability identified has been discovered in the Splunk Secure Gateway app, affecting various versions of Splunk Enterprise and the Splunk Cloud Platform.The vulnerability tracked as CVE ... Read more
-
TheCyberThrone
AuthQuake vulnerability with Microsoft to Bypass MFA
Cybersecurity researchers at Oasis Security have discovered a significant vulnerability in Microsoft’s Multi-Factor Authentication (MFA) system, which they have named AuthQuake.This vulnerability allo ... Read more
-
TheCyberThrone
Apache Superset 4.1.0 released with bug fixes
The Apache Software Foundation has announced the release of Apache Superset 4.1.0 with several bug fixes that could potentially allow attackers to bypass security controls, access sensitive data, and ... Read more
-
TheCyberThrone
Google fixes important vulnerabilities with the latest Google Chrome
Google has released updates for its Chrome browser, addressing several security vulnerabilities, including two important vulnerabilities.The first vulnerability tracked as CVE-2024-12381 with a CVSSv3 ... Read more
-
TheCyberThrone
CISA adds CVE-2024-49138 to its KEV Catalog
The US CISA adds Microsoft vulnerability to its Known Exploited Vulnerabilities Catalog based on the evidence of active exploitation.The vulnerability tracked as CVE-2024-49138 with a CVSS score of 7. ... Read more
-
TheCyberThrone
Exploit Code Released for Microsoft CVE-2024-38193
A critical use-after-free vulnerability, tracked as CVE-2024-38193 with a CVSS score of 7.8, has been discovered in the afd.sys Windows driver that allows attackers to escalate privileges and execute ... Read more
-
TheCyberThrone
Django was affected by CVE-2024-53907 and CVE-2024-53908
The Django team has released Django 5.1.4, Django 5.0.10, and Django 4.2.17 versions to address two security vulnerabilities.The first vulnerability tracked as CVE-2024-53907 with a CVSS score of 7.5 ... Read more
-
TheCyberThrone
SonicWall addressed half a dozen vulnerabilities in SMA 100 series
SonicWall has released patches for several (six) vulnerabilities impacting its SMA 100 series SSL-VPN products. These flaws range from path traversal issues inherited from the Apache HTTP Server to cr ... Read more
-
TheCyberThrone
SailPoint IdentityIQ affected by CVE-2024-10905
SailPoint IdentityIQ has been affected by a critical vulnerability, that could allow sensitive data exposureThe vulnerability tracked as CVE-2024-10905 with a CVSS score of 10.0, stems from improper a ... Read more
-
TheCyberThrone
CISA Adds CyberPanel Flaw CVE-2024-51378 to KEV Catalog
The CISA has warned about a critical vulnerability in CyberPanel tracked as CVE-2024-51378, is being actively exploited by attackers to deploy ransomware and added to the known exploited vulnerability ... Read more
-
TheCyberThrone
POC Exploit released for WhatsUp Gold CVE-2024-8785
Security researchers have published a proof-of-concept (PoC) exploit for CVE-2024-8785 with a CVSS score of 9.8, a critical remote code execution vulnerability affecting Progress WhatsUp Gold,A critic ... Read more
-
TheCyberThrone
Google Patches CVE-2024-12053 in Chrome
Google has released patches for a high severity vulnerability in its popular Chrome web browser residing within the V8 JavaScript engine and allow attackers to execute arbitrary code on users’ system ... Read more
-
TheCyberThrone
CISA KEV Catalog Update Part I – December 2024
The US CISA has added the below vulnerabilities to its Known Exploited Vulnerabilities Catalog based on the evidence of active exploitation.CVE-2023-45727 Tracked as CWE-611, North Grid Proself Enterp ... Read more
-
TheCyberThrone
IBM fixes multiple vulnerabilities including CVE-2024-49803
IBM has released patches for multiple vulnerabilities, that could lead to a remote code execution to hard-coded credentials and privilege escalation that potentially compromising sensitive data and d ... Read more
The following table lists the changes that have been made to the
CVE-2024-50379 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 01, 2025
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions from (including) 10.1.0 up to (excluding) 10.1.34 *cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions from (including) 11.0.0 up to (excluding) 11.0.2 *cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions from (including) 9.0.0 up to (excluding) 9.0.98 Added CPE Configuration AND OR *cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:* OR cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* Added Reference Type CVE: http://www.openwall.com/lists/oss-security/2024/12/17/4 Types: Mailing List Added Reference Type CVE: http://www.openwall.com/lists/oss-security/2024/12/18/2 Types: Mailing List Added Reference Type Apache Software Foundation: https://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r Types: Mailing List, Vendor Advisory Added Reference Type CVE: https://security.netapp.com/advisory/ntap-20250103-0003/ Types: Third Party Advisory -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Jan. 03, 2025
Action Type Old Value New Value Added Reference https://security.netapp.com/advisory/ntap-20250103-0003/ -
CVE Modified by [email protected]
Dec. 19, 2024
Action Type Old Value New Value Changed Description Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.08, which fixes the issue. Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue. -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Dec. 18, 2024
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2024/12/18/2 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Dec. 17, 2024
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2024/12/17/4 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Dec. 17, 2024
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by [email protected]
Dec. 17, 2024
Action Type Old Value New Value Added Description Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.08, which fixes the issue. Added CWE CWE-367 Added Reference https://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-50379 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-50379
weaknesses.