QwikSec

Security Database

CVE

CWE

Training

CVE-2021-24122

Published: Jan 14, 2021

Modified: Feb 13, 2025

PUBLISHED

Description

When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.

Vendor	Product	Versions
Apache Software Foundation	Apache Tomcat	affected `Apache Tomcat 10 - < 10.0.0-M10` affected `Apache Tomcat 9 - < 9.0.40` affected `Apache Tomcat 8.5 - < 8.5.60` affected `Apache Tomcat 7 - < 7.0.106`

Weaknesses (CWE)

References

https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E

x_refsource_MISC

[tomcat-announce] 20210114 [SECURITY] CVE-2021-24122 Apache Tomcat Information Disclosure

mailing-list

x_refsource_MLIST

[tomcat-dev] 20210114 svn commit: r1885488 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml

mailing-list

x_refsource_MLIST

[tomee-dev] 20210114 Re: Releases?

mailing-list

x_refsource_MLIST

[oss-security] 20210114 [SECURITY] CVE-2021-24122 Apache Tomcat Information Disclosure

mailing-list

x_refsource_MLIST

[announce] 20210114 [SECURITY] CVE-2021-24122 Apache Tomcat Information Disclosure

mailing-list

x_refsource_MLIST

[tomcat-dev] 20210114 [SECURITY] CVE-2021-24122 Apache Tomcat Information Disclosure

mailing-list

x_refsource_MLIST

[tomcat-users] 20210114 [SECURITY] CVE-2021-24122 Apache Tomcat Information Disclosure

mailing-list

x_refsource_MLIST

[tomee-dev] 20210115 CVE-2021-24122 NTFS Information Disclosure Bug

mailing-list

x_refsource_MLIST

[debian-lts-announce] 20210316 [SECURITY] [DLA 2596-1] tomcat8 security update

mailing-list

x_refsource_MLIST

https://www.oracle.com//security-alerts/cpujul2021.html

x_refsource_MISC

https://security.netapp.com/advisory/ntap-20210212-0008/

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.