CVE-2024-56337 Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete

🗓️ 20 Dec 2024 15:28:54Reported by apacheType

Apache Tomcat RCE vulnerability due to incomplete CVE-2024-50379 mitigation and TOCTOU issue.

Reporter	Title	Published	Views	Family All 343
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	20 Dec 202421:30	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	19 Dec 202402:43	–	githubexploit
GithubExploit	Exploit for CVE-2025-55752	29 Oct 202508:27	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	23 Dec 202414:11	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	25 Dec 202418:42	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	18 Dec 202419:53	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	30 Mar 202517:15	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	20 Jun 202616:07	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	20 Dec 202405:24	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	21 Dec 202405:54	–	githubexploit

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Tomcat",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "11.0.1",
        "status": "affected",
        "version": "11.0.0-M1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.1.33",
        "status": "affected",
        "version": "10.1.0-M1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "9.0.97",
        "status": "affected",
        "version": "9.0.0.M1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "8.5.100",
        "status": "affected",
        "version": "8.5.0",
        "versionType": "semver"
      },
      {
        "lessThan": "8.5.0",
        "status": "unknown",
        "version": "3",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.0.27",
        "status": "unknown",
        "version": "10.0.0-M1",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
cve	www.cve.org/CVERecord
lists	www.lists.apache.org/thread/b2b9qrgjrz1kvo4ym8y2wkfdvwoq6qbp

29 Oct 2025 11:52Current

EPSS0.43663

CWE-367