CVE-2024-56337

🗓️ 20 Dec 2024 15:28:54Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 909 Views🌐 WEB

CVEs for Time-of-check Time-of-use vulnerability in Apache Tomcat requiring configuration changes.

Reporter	Title	Published	Views	Family All 204
IBM Security Bulletins	Security Bulletin: IBM Integration Bus for z/OS is vulnerable to a remote attack and a race condition vulnerability due to Apache Tomcat (CVE-2024-56337, CVE-2024-52316 and CVE-2024-50379)	28 Jan 202521:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a TOCTOU Race Condition vulnerability in Apache Tomcat [CVE-2024-56337]	27 Feb 202515:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge v4.8.8 is vulnerable to a Race Condition vulnerability in Apache Tomcat [CVE-2024-56337]	1 May 202519:42	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Tomcat might affect IBM Storage Defender Copy Data Management.	16 May 202519:24	–	ibm
IBM Security Bulletins	Security Bulletin: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability affects watsonx.data	3 Mar 202511:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in tomcat-embed-core	10 Mar 202518:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Broker Component uses CVE-2024-56337 tomcat-embed-core-10.1.33.jar (Publicly disclosed vulnerability found by Mend) CVE-2024-56337	20 Feb 202505:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Analytics Content Hub is affected by security vulnerabilities	9 Jul 202523:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities	15 Apr 202502:36	–	ibm
Tenable Nessus	Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2025-813)	24 Jan 202500:00	–	nessus

NVD

Vulners

Node

apache tomcatRange9.0.0–9.0.98

apache tomcatRange10.1.0–10.1.34

apache tomcatRange11.0.0–11.0.2

Node

AND

netapp bootstrap_osMatch-

netapp hci_compute_nodeMatch-

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Tomcat",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "11.0.1",
        "status": "affected",
        "version": "11.0.0-M1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.1.33",
        "status": "affected",
        "version": "10.1.0-M1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "9.0.97",
        "status": "affected",
        "version": "9.0.0.M1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "8.5.100",
        "status": "affected",
        "version": "8.5.0",
        "versionType": "semver"
      },
      {
        "lessThan": "8.5.0",
        "status": "unknown",
        "version": "3",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.0.27",
        "status": "unknown",
        "version": "10.0.0-M1",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
cve	www.cve.org/CVERecord
lists	www.lists.apache.org/thread/b2b9qrgjrz1kvo4ym8y2wkfdvwoq6qbp
security	www.security.netapp.com/advisory/ntap-20250103-0002/
lists	www.lists.debian.org/debian-lts-announce/2025/01/msg00009.html

Parameter	Position	Path	Description	CWE
p	path	/ggsl.jsp	TOCTOU race condition vulnerability in Apache Tomcat (CWE-367) that allows saving a JSP shell via the default servlet when write is enabled on a case-insensitive filesystem; the payload shell.jsp can be saved to ggsl.jsp on the target.	CWE-367

17 Jun 2026 08:12Current

9.2Critical risk

Vulners AI Score9.2

CVSS 3.19.8

EPSS0.08969

SSVC

CWE-367