← Back

CVE-2021-24122

nvd nist
Published: Jan 14, 2021Modified: Jun 17, 2026

JSON object

Loading...
5.9
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.2 / Impact: 3.6
Source: NVD

Description

When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.

Affected (42)

Apache
1 product
Tomcat
Debian
1 product
Debian Linux
Oracle
1 product
Agile Plm
Configuration A
39 vulnerable
Vulnerable SoftwareAffected Versions
Apache
Tomcat
From 7.0.0 to 7.0.106
Tomcat
From 8.5.0 to 8.5.59
Tomcat
From 9.0.1 to 9.0.39
Tomcat
Version 10.0.0 milestone1
Tomcat
Version 10.0.0 milestone2
Tomcat
Version 10.0.0 milestone3
Tomcat
Version 10.0.0 milestone4
Tomcat
Version 10.0.0 milestone5
Tomcat
Version 10.0.0 milestone6
Tomcat
Version 10.0.0 milestone7
Tomcat
Version 10.0.0 milestone8
Tomcat
Version 10.0.0 milestone9
Tomcat
Version 9.0.0 milestone10
Tomcat
Version 9.0.0 milestone11
Tomcat
Version 9.0.0 milestone12
Tomcat
Version 9.0.0 milestone13
Tomcat
Version 9.0.0 milestone14
Tomcat
Version 9.0.0 milestone15
Tomcat
Version 9.0.0 milestone16
Tomcat
Version 9.0.0 milestone17
Tomcat
Version 9.0.0 milestone18
Tomcat
Version 9.0.0 milestone19
Tomcat
Version 9.0.0 milestone1
Tomcat
Version 9.0.0 milestone20
Tomcat
Version 9.0.0 milestone21
Tomcat
Version 9.0.0 milestone22
Tomcat
Version 9.0.0 milestone23
Tomcat
Version 9.0.0 milestone24
Tomcat
Version 9.0.0 milestone25
Tomcat
Version 9.0.0 milestone26
Tomcat
Version 9.0.0 milestone27
Tomcat
Version 9.0.0 milestone2
Tomcat
Version 9.0.0 milestone3
Tomcat
Version 9.0.0 milestone4
Tomcat
Version 9.0.0 milestone5
Tomcat
Version 9.0.0 milestone6
Tomcat
Version 9.0.0 milestone7
Tomcat
Version 9.0.0 milestone8
Tomcat
Version 9.0.0 milestone9
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Debian Linux
Version 9.0
Configuration C
2 vulnerable
Vulnerable SoftwareAffected Versions
Oracle
Agile Plm
Version 9.3.3
Agile Plm
Version 9.3.6

Related CWEs

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-706
Use of Incorrectly-Resolved Name or Reference
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

References (28)

Source: security@apache.org
Mailing ListThird Party Advisory
Source: security@apache.org
Source: security@apache.org
Mailing ListVendor Advisory
Source: security@apache.org
Mailing ListVendor Advisory
Source: security@apache.org
Mailing ListVendor Advisory
Source: security@apache.org
Mailing ListVendor Advisory
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Source: security@apache.org
Mailing ListThird Party Advisory
Source: security@apache.org
Third Party Advisory
Source: security@apache.org
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.