BIT-TOMCAT-2024-52318 Apache Tomcat: Incorrect JSP tag recycling leads to XSS

🗓️ 20 Nov 2024 07:19:59Reported by GoogleType

osv🔗 osv.dev👁 32 Views

Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96.Users are recommended to upgrade to version 11.0.1, 10.1.32 or 9.0.97, which fixes the issue

Reporter	Title	Published	Views	Family All 62
IBM Security Bulletins	Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to object recycling and reuse vulnerability in Apache Tomcat (CVE-2024-52318)	7 Feb 202519:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DevOps Release addresses multiple vulnerabilities related to Apache Tomcat.	23 Jun 202513:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DevOps Build addresses multiple vulnerabilities.	25 Jun 202511:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilites in IBM Rational Build Forge.	24 Jun 202506:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security SOAR is using a component with known vulnerabilities (CVE-2024-52316, CVE-2024-52317, CVE-2024-52318)	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Tomcat Server (CVE-2024-52318) affects Power HMC.	18 Feb 202511:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities	11 Dec 202418:44	–	ibm
Tenable Nessus	Apache Tomcat < 11.0.1 Vulnerability	18 Nov 202400:00	–	nessus
Tenable Nessus	Apache Tomcat < 10.1.33 Vulnerability	18 Nov 202400:00	–	nessus
Tenable Nessus	Apache Tomcat < 9.0.97 Vulnerability	18 Nov 202400:00	–	nessus

Source	Link
lists	www.lists.apache.org/thread/co243cw1nlh6p521c5265cm839wkqdp9
openwall	www.openwall.com/lists/oss-security/2024/11/18/4
security	www.security.netapp.com/advisory/ntap-20250131-0009/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-52318

09 Jul 2025 15:43Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.1

EPSS0.01676

SSVC