{
"id": "GHSA-2rvv-w9r2-rg7m",
"aliases": [
"CVE-2021-24122"
],
"details": "When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.",
"summary": "Information Disclosure in Apache Tomcat",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.0.0-M1"
},
{
"fixed": "10.0.0-M10"
}
]
}
],
"package": {
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"ecosystem": "Maven"
},
"database_specific": {
"last_known_affected_version_range": "<= 10.0.0-M9"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.0.40"
}
]
}
],
"package": {
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"ecosystem": "Maven"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.5.0"
},
{
"fixed": "8.5.60"
}
]
}
],
"package": {
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"ecosystem": "Maven"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.107"
}
]
}
],
"package": {
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"ecosystem": "Maven"
}
}
],
"modified": "2024-03-11T16:32:22Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"published": "2021-05-13T22:30:02Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24122",
"type": "ADVISORY"
},
{
"url": "https://github.com/apache/tomcat/commit/7f004ac4531c45f9a2a2d1470561fe135cf27bc2",
"type": "WEB"
},
{
"url": "https://github.com/apache/tomcat/commit/800b03140e640f8892f27021e681645e8e320177",
"type": "WEB"
},
{
"url": "https://github.com/apache/tomcat/commit/920dddbdb981f92e8d5872a4bb126a10af5ca8a9",
"type": "WEB"
},
{
"url": "https://github.com/apache/tomcat/commit/935fc5582dc25ae10bab6f9d5629ff8d996cb533",
"type": "WEB"
},
{
"url": "https://www.oracle.com//security-alerts/cpujul2021.html",
"type": "WEB"
},
{
"url": "https://tomcat.apache.org/security-9.html",
"type": "WEB"
},
{
"url": "https://tomcat.apache.org/security-8.html",
"type": "WEB"
},
{
"url": "https://tomcat.apache.org/security-7.html",
"type": "WEB"
},
{
"url": "https://tomcat.apache.org/security-10.html",
"type": "WEB"
},
{
"url": "https://security.netapp.com/advisory/ntap-20210212-0008",
"type": "WEB"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937@%3Cdev.tomcat.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/rb32a73b7cb919d4f44a2596b6b951274c0004fc8b0e393d6829a45f9@%3Cusers.tomcat.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/r7e0bb9ea415724550e2b325e143b23e269579e54d66fcd7754bd0c20@%3Cdev.tomcat.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/r776c64337495bf28b7d5597268114a888e3fad6045c40a0da0c66d4d@%3Cdev.tomee.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/r7382e1e35b9bc7c8f320b90ad77e74c13172d08034e20c18000fe710@%3Cdev.tomee.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52@%3Cannounce.tomcat.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52@%3Cannounce.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E",
"type": "WEB"
},
{
"url": "https://github.com/apache/tomcat",
"type": "PACKAGE"
},
{
"url": "http://www.openwall.com/lists/oss-security/2021/01/14/1",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-706"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": "2021-01-14T15:15:00Z",
"github_reviewed_at": "2021-04-06T21:27:31Z"
}
}