CVE-2021-24122 : When serving resources from a network location using the NTFS file system, Apach

When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.

Published 2021-01-14 15:15:13

Updated 2022-10-24 17:00:52

Source Apache Software Foundation

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2021-24122

Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat
Versions from including (>=) 8.5.0 and up to, including, (<=) 8.5.59
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat
Versions from including (>=) 9.0.1 and up to, including, (<=) 9.0.39
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat
Versions from including (>=) 7.0.0 and up to, including, (<=) 7.0.106
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone1
cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone10
cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone11
cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone12
cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone13
cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone14
cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone15
cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone16
cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone17
cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone18
cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone19
cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone2
cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone20
cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone21
cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone22
cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone23
cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone24
cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone25
cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone26
cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone27
cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone3
cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone4
cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone5
cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone6
cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone7
cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone8
cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone9
cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 10.0.0 Update Milestone1
cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 10.0.0 Update Milestone2
cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 10.0.0 Update Milestone3
cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 10.0.0 Update Milestone4
cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 10.0.0 Update Milestone5
cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 10.0.0 Update Milestone6
cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 10.0.0 Update Milestone7
cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 10.0.0 Update Milestone8
cpe:2.3:a:apache:tomcat:10.0.0:milestone8:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 10.0.0 Update Milestone9
cpe:2.3:a:apache:tomcat:10.0.0:milestone9:*:*:*:*:*:*
Matching versions
Oracle » Agile Plm » Version: 9.3.6
cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
Matching versions
Oracle » Agile Plm » Version: 9.3.3
cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2021-24122

Top countries where our scanners detected CVE-2021-24122

Top open port discovered on systems with this issue 80

IPs affected by CVE-2021-24122 420,218

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2021-24122!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2021-24122

EPSS FAQ

0.38%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 74 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-24122

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.9	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	2.2	3.6	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2021-24122

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: security@apache.org (Secondary)
CWE-706 Use of Incorrectly-Resolved Name or Reference

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-24122

http://www.openwall.com/lists/oss-security/2021/01/14/1

oss-security - [SECURITY] CVE-2021-24122 Apache Tomcat Information Disclosure
Mailing List;Third Party Advisory
https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52@%3Cannounce.tomcat.apache.org%3E

Pony Mail!
Mailing List;Vendor Advisory
https://lists.apache.org/thread.html/r776c64337495bf28b7d5597268114a888e3fad6045c40a0da0c66d4d@%3Cdev.tomee.apache.org%3E

Re: Releases? - Pony Mail
Mailing List;Vendor Advisory
https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52@%3Cannounce.apache.org%3E

[SECURITY] CVE-2021-24122 Apache Tomcat Information Disclosure - Pony Mail
Mailing List;Vendor Advisory
https://www.oracle.com//security-alerts/cpujul2021.html

Oracle Critical Patch Update Advisory - July 2021
Third Party Advisory

CVEs referencing this url
https://lists.apache.org/thread.html/r7e0bb9ea415724550e2b325e143b23e269579e54d66fcd7754bd0c20@%3Cdev.tomcat.apache.org%3E

[SECURITY] CVE-2021-24122 Apache Tomcat Information Disclosure - Pony Mail
Mailing List;Vendor Advisory
https://lists.apache.org/thread.html/r7382e1e35b9bc7c8f320b90ad77e74c13172d08034e20c18000fe710@%3Cdev.tomee.apache.org%3E

CVE-2021-24122 NTFS Information Disclosure Bug - Pony Mail
Mailing List;Vendor Advisory
https://lists.apache.org/thread.html/rb32a73b7cb919d4f44a2596b6b951274c0004fc8b0e393d6829a45f9@%3Cusers.tomcat.apache.org%3E

[SECURITY] CVE-2021-24122 Apache Tomcat Information Disclosure - Pony Mail
Mailing List;Vendor Advisory
https://security.netapp.com/advisory/ntap-20210212-0008/

CVE-2021-24122 Apache Tomcat Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory
https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937@%3Cdev.tomcat.apache.org%3E

svn commit: r1885488 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs
Mailing List;Vendor Advisory

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html

[SECURITY] [DLA 2596-1] tomcat8 security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E

[SECURITY] CVE-2021-24122 Apache Tomcat Information Disclosure - Pony Mail
Mailing List;Vendor Advisory