Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.

The version of tomcat installed on the remote host is prior to 9.0.98-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT9-2025-015 advisory.

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat     permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default     configuration).

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.0.97.

    Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
    (CVE-2024-50379)

    Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta     Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the     authentication process without explicitly setting an HTTP status to indicate failure, the authentication     may not fail, allowing the user to bypass the authentication process. There are no known Jakarta     Authentication components that behave in this way.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from     9.0.0-M1 through 9.0.95.

    Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.
    (CVE-2024-52316)

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.0.97.

    The mitigation for CVE-2024-50379 was incomplete.

    Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly     initialisationparameter set to the non-default value of false) may need additional configuration to fully     mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:- running on Java 8     or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to     true)- running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it     defaults to false)- running on Java 21 onwards: no further configuration is required (the system property     and the problematic cache have been removed)

    Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set     appropriately before allowing the default servlet to be write enabled on a case insensitive file system.
    Tomcat will also set sun.io.useCanonCaches to false by default where it can. (CVE-2024-56337)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-814 advisory.

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat     permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default     configuration).

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.0.97.

    Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
    (CVE-2024-50379)

    Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta     Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the     authentication process without explicitly setting an HTTP status to indicate failure, the authentication     may not fail, allowing the user to bypass the authentication process. There are no known Jakarta     Authentication components that behave in this way.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from     9.0.0-M1 through 9.0.95.

    Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.
    (CVE-2024-52316)

    Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request     and response used by HTTP/2 requestscould lead to request and/or response mix-up between users.

    This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from     9.0.92 through 9.0.95.

    Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.
    (CVE-2024-52317)

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.0.97.

    The mitigation for CVE-2024-50379 was incomplete.

    Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly     initialisationparameter set to the non-default value of false) may need additional configuration to fully     mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:- running on Java 8     or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to     true)- running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it     defaults to false)- running on Java 21 onwards: no further configuration is required (the system property     and the problematic cache have been removed)

    Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set     appropriately before allowing the default servlet to be write enabled on a case insensitive file system.
    Tomcat will also set sun.io.useCanonCaches to false by default where it can. (CVE-2024-56337)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-813 advisory.

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat     permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default     configuration).

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.0.97.

    Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
    (CVE-2024-50379)

    Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta     Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the     authentication process without explicitly setting an HTTP status to indicate failure, the authentication     may not fail, allowing the user to bypass the authentication process. There are no known Jakarta     Authentication components that behave in this way.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from     9.0.0-M1 through 9.0.95.

    Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.
    (CVE-2024-52316)

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.0.97.

    The mitigation for CVE-2024-50379 was incomplete.

    Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly     initialisationparameter set to the non-default value of false) may need additional configuration to fully     mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:- running on Java 8     or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to     true)- running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it     defaults to false)- running on Java 21 onwards: no further configuration is required (the system property     and the problematic cache have been removed)

    Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set     appropriately before allowing the default servlet to be write enabled on a case insensitive file system.
    Tomcat will also set sun.io.useCanonCaches to false by default where it can. (CVE-2024-56337)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5845 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5845-1                   security@debian.org     https://www.debian.org/security/                          Markus Koschany     January 17, 2025                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : tomcat10     CVE ID         : CVE-2024-34750 CVE-2024-38286 CVE-2024-50379 CVE-2024-52316                      CVE-2024-54677 CVE-2024-56337

    Several problems have been addressed in Tomcat 10, a Java based web server,     servlet and JSP engine which may lead to a denial-of-service.


    CVE-2024-38286

        Apache Tomcat, under certain configurations, allows an attacker to cause an         OutOfMemoryError by abusing the TLS handshake process.

    CVE-2024-52316

        Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is         configured to use a custom Jakarta Authentication (formerly JASPIC)         ServerAuthContext component which may throw an exception during the         authentication process without explicitly setting an HTTP status to         indicate failure, the authentication may not fail, allowing the user to         bypass the authentication process. There are no known Jakarta         Authentication components that behave in this way.

    CVE-2024-50379 / CVE-2024-56337

        Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP         compilation in Apache Tomcat permits an RCE on case insensitive file         systems when the default servlet is enabled for write (non-default         configuration).
        Some users may need additional configuration to fully mitigate         CVE-2024-50379 depending on which version of Java they are using with         Tomcat. For Debian 12 bookworm the system property         sun.io.useCanonCaches must be explicitly set to false (it defaults to         false). Most Debian users will not be affected because Debian uses case         sensitive file systems by default.

    CVE-2024-34750

        Improper Handling of Exceptional Conditions, Uncontrolled Resource         Consumption vulnerability in Apache Tomcat. When processing an HTTP/2         stream, Tomcat did not handle some cases of excessive HTTP headers         correctly. This led to a miscounting of active HTTP/2 streams which in turn         led to the use of an incorrect infinite timeout which allowed connections         to remain open which should have been closed.

    CVE-2024-54677

        Uncontrolled Resource Consumption vulnerability in the examples web         application provided with Apache Tomcat leads to denial of service.


    For the stable distribution (bookworm), these problems have been fixed in     version 10.1.34-0+deb12u1.

    We recommend that you upgrade your tomcat10 packages.

    For the detailed security status of tomcat10 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/tomcat10

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4017 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4017-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     January 17, 2025                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : tomcat9     Version        : 9.0.43-2~deb11u11     CVE ID         : CVE-2024-21733 CVE-2024-38286 CVE-2024-50379 CVE-2024-52316                      CVE-2024-56337

    Several problems have been addressed in Tomcat 9, a Java based web server,     servlet and JSP engine which may lead to a denial-of-service or the disclosure     of sensitive information.

    CVE-2024-21733

        Generation of Error Message Containing Sensitive Information vulnerability         in Apache Tomcat.

    CVE-2024-38286

        Apache Tomcat, under certain configurations, allows an attacker to cause an         OutOfMemoryError by abusing the TLS handshake process.

    CVE-2024-52316

        Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is         configured to use a custom Jakarta Authentication (formerly JASPIC)         ServerAuthContext component which may throw an exception during the         authentication process without explicitly setting an HTTP status to         indicate failure, the authentication may not fail, allowing the user to         bypass the authentication process. There are no known Jakarta         Authentication components that behave in this way.

    CVE-2024-50379 / CVE-2024-56337

        Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP         compilation in Apache Tomcat permits an RCE on case insensitive file         systems when the default servlet is enabled for write (non-default         configuration).
        Some users may need additional configuration to fully mitigate         CVE-2024-50379 depending on which version of Java they are using with         Tomcat. For Debian 11 bullseye the system property         sun.io.useCanonCaches must be explicitly set to false (it defaults to         true). Most Debian users will not be affected because Debian uses case         sensitive file systems by default.

    For Debian 11 bullseye, these problems have been fixed in version     9.0.43-2~deb11u11.

    We recommend that you upgrade your tomcat9 packages.

    For the detailed security status of tomcat9 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/tomcat9

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the apache package has been released.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ed0a052a-c5e6-11ef-a457-b42e991fc52e advisory.

    security@apache.org reports:
    Time-of-check Time-of-use (TOCTOU) Race Condition             The mitigation for CVE-2024-50379 was incomplete.
            Users running Tomcat on a case insensitive file system with the             default servlet write enabled (readonly initialisation parameter             set to the non-default value of false) may need additional configuration             to fully mitigate CVE-2024-50379 depending on which version of Java             they are using with Tomcat: - running on Java 8 or Java 11: the             system propertysun.io.useCanonCaches must be explicitly set to false             (it defaults to true) - running on Java 17: thesystem property             sun.io.useCanonCaches, if set, must be set to false(it defaults to             false) - running on Java 21 onwards: no further configuration is             required(the system property and the problematic cache have been             removed)             Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks             thatsun.io.useCanonCaches is set appropriately before allowing the             default servlet to be write enabled on a case insensitive file             system.  Tomcat will also setsun.io.useCanonCaches to false by             default where it can.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host 9.0.0-M1 to 9.0.97, 10.1.0-M1 to 10.1.33 or 11.0.0-M1 to 11.0.1. It is, therefore, affected by multiple vulnerabilities :

 - The previous mitigation for CVE-2024-50379 was incomplete. In addition to upgrading to 11.0.2 or later, users running Tomcat on a case insensitive file system with the default servlet write enabled may need additional configuration depending on the version of Java being used. (CVE-2024-56337)

 - Numerous examples in the examples web application did not place limits on uploaded data enabling an OutOfMemoryError to be triggered causing a denial of service. (CVE-2024-54677)

 - If the default servlet is write enabled (readonly initialisation parameter set to the non-default value of false) for a case insensitive file system, concurrent read and upload under load of the same file can bypass Tomcat's case sensitivity checks and cause an uploaded file to be treated as a JSP leading to remote code execution. (CVE-2024-50379)

Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 9.0.98. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_9.0.98_security-9 advisory.

  - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat     permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default     configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through     10.1.33, from 9.0.0.M1 through 9.0.97. Users are recommended to upgrade to version 11.0.2, 10.1.34 or     9.0.98, which fixes the issue. (CVE-2024-50379)

  - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects     Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through     9.0.97. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file     system with the default servlet write enabled (readonly initialisation parameter set to the non-default     value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which     version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property     sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the     system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on     Java 21 onwards: no further configuration is required (the system property and the problematic cache have     been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is     set appropriately before allowing the default servlet to be write enabled on a case insensitive file     system. Tomcat will also set sun.io.useCanonCaches to false by default where it can. (CVE-2024-56337)

  - Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache     Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from     10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. Users are recommended to upgrade to version     11.0.2, 10.1.34 or 9.0.98, which fixes the issue. (CVE-2024-54677)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 10.1.34. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_10.1.34_security-10 advisory.

  - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat     permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default     configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through     10.1.33, from 9.0.0.M1 through 9.0.97. Users are recommended to upgrade to version 11.0.2, 10.1.34 or     9.0.98, which fixes the issue. (CVE-2024-50379)

  - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects     Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through     9.0.97. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file     system with the default servlet write enabled (readonly initialisation parameter set to the non-default     value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which     version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property     sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the     system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on     Java 21 onwards: no further configuration is required (the system property and the problematic cache have     been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is     set appropriately before allowing the default servlet to be write enabled on a case insensitive file     system. Tomcat will also set sun.io.useCanonCaches to false by default where it can. (CVE-2024-56337)

  - Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache     Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from     10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. Users are recommended to upgrade to version     11.0.2, 10.1.34 or 9.0.98, which fixes the issue. (CVE-2024-54677)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 11.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_11.0.2_security-11 advisory.

  - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat     permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default     configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through     10.1.33, from 9.0.0.M1 through 9.0.97. Users are recommended to upgrade to version 11.0.2, 10.1.34 or     9.0.98, which fixes the issue. (CVE-2024-50379)

  - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects     Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through     9.0.97. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file     system with the default servlet write enabled (readonly initialisation parameter set to the non-default     value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which     version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property     sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the     system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on     Java 21 onwards: no further configuration is required (the system property and the problematic cache have     been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is     set appropriately before allowing the default servlet to be write enabled on a case insensitive file     system. Tomcat will also set sun.io.useCanonCaches to false by default where it can. (CVE-2024-56337)

  - Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache     Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from     10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. Users are recommended to upgrade to version     11.0.2, 10.1.34 or 9.0.98, which fixes the issue. (CVE-2024-54677)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
214622	Amazon Linux 2 : tomcat (ALASTOMCAT9-2025-015)	Nessus	Amazon Linux Local Security Checks	critical
214611	Amazon Linux 2023 : tomcat10, tomcat10-admin-webapps, tomcat10-el-5.0-api (ALAS2023-2025-814)	Nessus	Amazon Linux Local Security Checks	critical
214604	Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2025-813)	Nessus	Amazon Linux Local Security Checks	critical
214338	Debian dsa-5845 : libtomcat10-embed-java - security update	Nessus	Debian Local Security Checks	critical
214321	Debian dla-4017 : libtomcat9-embed-java - security update	Nessus	Debian Local Security Checks	medium
214266	Photon OS 4.0: Apache PHSA-2025-4.0-0729	Nessus	PhotonOS Local Security Checks	critical
213442	FreeBSD : Apache Tomcat -- RCE due to TOCTOU issue in JSP compilation (ed0a052a-c5e6-11ef-a457-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	critical
114548	Apache Tomcat 9.0.0-M1 < 9.0.98 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114547	Apache Tomcat 10.1.0-M1 < 10.1.34 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114546	Apache Tomcat 11.0.0-M1 < 11.0.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
213078	Apache Tomcat 9.0.0.M1 < 9.0.98 multiple vulnerabilities	Nessus	Web Servers	critical
213077	Apache Tomcat 10.1.0.M1 < 10.1.34 multiple vulnerabilities	Nessus	Web Servers	critical
213076	Apache Tomcat 11.0.0.M1 < 11.0.2 multiple vulnerabilities	Nessus	Web Servers	critical

Detections

Analytics

CVE-2024-56337

critical

Tenable Plugins

critical

critical

critical

critical

medium

critical

critical

critical

critical

critical

critical

critical

critical