CVE-2025-24813

{"id": "CVE-2025-24813", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "published": "2025-03-10T17:15:35.067", "references": [{"url": "https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "http://www.openwall.com/lists/oss-security/2025/03/10/5", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00003.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.netapp.com/advisory/ntap-20250321-0001/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-24813-detect-apache-tomcat-rce", "tags": ["Issue Tracking"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-24813-mitigate-apache-tomcat-rce", "tags": ["Issue Tracking"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-detect-vulnerability", "tags": ["Issue Tracking"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-mitigation-vulnerability", "tags": ["Issue Tracking"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/absholi7ly/POC-CVE-2025-24813/blob/main/README.md", "tags": ["Exploit"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24813", "tags": ["Third Party Advisory", "US Government Resource"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-44"}, {"lang": "en", "value": "CWE-502"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-502"}, {"lang": "en", "value": "CWE-706"}]}], "descriptions": [{"lang": "en", "value": "Path Equivalence: 'file.Name' (Internal Dot) leading to\u00a0Remote Code Execution and/or Information disclosure\u00a0and/or malicious content added to uploaded files via write enabled\u00a0Default Servlet\u00a0in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nIf all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:\n-\u00a0writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of\u00a0a target URL for public uploads\n-\u00a0attacker knowledge of the names of security sensitive files being\u00a0uploaded\n-\u00a0the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n-\u00a0support for partial PUT (enabled by default)\n-\u00a0application was using Tomcat's file based session persistence with the\u00a0default storage location\n-\u00a0application included a library that may be leveraged in a\u00a0deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue."}, {"lang": "es", "value": "Equivalencia de ruta: 'file.Name' (punto interno) que conduce a la ejecuci\u00f3n remota de c\u00f3digo y/o divulgaci\u00f3n de informaci\u00f3n y/o contenido malicioso agregado a los archivos cargados a trav\u00e9s del servlet predeterminado habilitado para escritura en Apache Tomcat. Este problema afecta a Apache Tomcat: desde 11.0.0-M1 hasta 11.0.2, desde 10.1.0-M1 hasta 10.1.34, desde 9.0.0.M1 hasta 9.0.98. Si todo lo siguiente fuera cierto, un usuario malintencionado podr\u00eda ver archivos sensibles de seguridad y/o inyectar contenido en esos archivos: - escrituras habilitadas para el servlet predeterminado (deshabilitado por defecto) - soporte para PUT parcial (habilitado por defecto) - una URL de destino para cargas sensibles de seguridad que era un subdirectorio de una URL de destino para cargas p\u00fablicas - conocimiento del atacante de los nombres de los archivos sensibles de seguridad que se estaban cargando - los archivos sensibles de seguridad tambi\u00e9n se estaban cargando a trav\u00e9s de PUT parcial Si todo lo siguiente fuera cierto, un usuario malintencionado podr\u00eda realizar una ejecuci\u00f3n remota de c\u00f3digo: - escrituras habilitadas para el servlet predeterminado (deshabilitado por defecto) - soporte para PUT parcial (habilitado por defecto) - la aplicaci\u00f3n estaba usando la persistencia de sesi\u00f3n basada en archivos de Tomcat con la ubicaci\u00f3n de almacenamiento predeterminada - la aplicaci\u00f3n inclu\u00eda una biblioteca que se puede aprovechar en un ataque de deserializaci\u00f3n Se recomienda a los usuarios actualizar a la versi\u00f3n 11.0.3, 10.1.35 o 9.0.98, que corrige el problema."}], "lastModified": "2025-10-23T14:49:29.133", "cisaActionDue": "2025-04-22", "cisaExploitAdd": "2025-04-01", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EEADC2E0-4A95-47B8-B506-D8E677838967", "versionEndExcluding": "9.0.99"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "108D9F43-5A29-475E-9EE2-66CE8899B318", "versionEndExcluding": "10.1.35", "versionStartIncluding": "10.1.1"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B7E3D41F-F7C8-4BAB-A80B-287FACB0F7E4", "versionEndExcluding": "11.0.3", "versionStartIncluding": "11.0.1"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6D402B5D-5901-43EB-8E6A-ECBD512CE367"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33C71AE1-B38E-4783-BAC2-3CDA7B4D9EBA"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6BD4180-D3E8-42AB-96B1-3869ECF47F6C"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64668CCF-DBC9-442D-9E0F-FD40E1D0DDB7"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC64BB57-4912-481E-AE8D-C8FCD36142BB"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "49B43BFD-6B6C-4E6D-A9D8-308709DDFB44"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "919C16BD-79A7-4597-8D23-2CBDED2EF615"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81B27C03-D626-42EC-AE4E-1E66624908E3"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone17:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD81405D-81A5-4683-A355-B39C912DAD2D"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone18:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2DCE3576-86BC-4BB8-A5FB-1274744DFD7F"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone19:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5571F54A-2EAC-41B6-BDA9-7D33CFE97F70"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9846609D-51FC-4CDD-97B3-8C6E07108F14"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone20:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED30E850-C475-4133-BDE3-74CB3768D787"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E321FB4-0B0C-497A-BB75-909D888C93CB"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B0CAE57-AF7A-40E6-9519-F5C9F422C1BE"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7CB9D150-EED6-4AE9-BCBE-48932E50035E"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D334103F-F64E-4869-BCC8-670A5AFCC76C"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "941FCF7B-FFB6-4967-95C7-BB3D32C73DAF"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE1A9030-B397-4BA6-8E13-DA1503872DDB"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6284B74A-1051-40A7-9D74-380FEEEC3F88"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D1AA7FF6-E8E7-4BF6-983E-0A99B0183008"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "57088BDD-A136-45EF-A8A1-2EBF79CEC2CE"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B32D1D7A-A04F-444E-8F45-BB9A9E4B0199"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone12:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0092FB35-3B00-484F-A24D-7828396A4FF6"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone13:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB557E88-FA9D-4B69-AA6F-EAEE7F9B01AC"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone14:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "72D3C6F1-84FA-4F82-96C1-9A8DA1C1F30F"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone15:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3521C81B-37D9-48FC-9540-D0D333B9A4A4"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone16:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02A84634-A8F2-4BA9-B9F3-BEF36AEC5480"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone17:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ECBBC1F1-C86B-40AF-B740-A99F6B27682A"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone18:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D2206B2-F3FF-43F2-B3E2-3CAAC64C691D"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone19:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0495A538-4102-40D0-A35C-0179CFD52A9D"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2AAD52CE-94F5-4F98-A027-9A7E68818CB6"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77BA6600-0890-4BA1-B447-EC1746BAB4FD"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone21:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7914D26B-CBD6-4846-9BD3-403708D69319"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone22:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "123C6285-03BE-49FC-B821-8BDB25D02863"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A28C2E2-B7BC-46CE-94E4-AE3EF172AA47"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "069B0D8E-8223-4C4E-A834-C6235D6C3450"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone25:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6282085-5716-4874-B0B0-180ECDEE128F"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1F981F5-035A-4EDD-8A9F-481EE8BC7FF7"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "03A171AF-2EC8-4422-912C-547CDB58CAAA"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "538E68C4-0BA4-495F-AEF8-4EF6EE7963CF"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "49350A6E-5E1D-45B2-A874-3B8601B3ADCC"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F50942F-DF54-46C0-8371-9A476DD3EEA3"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D12C2C95-B79F-4AA4-8CE3-99A3EE7991AB"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "98792138-DD56-42DF-9612-3BDC65EEC117"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "95BA156C-C977-4F0C-8DFB-3FAE9CC8C02D"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "AD7447BC-F315-4298-A822-549942FC118B"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]", "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "cisaVulnerabilityName": "Apache Tomcat Path Equivalence Vulnerability"}