tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation

🗓️ 08 May 2025 12:15:06Reported by RedHatType

Tomcat CVE-2024-50379 fix incomplete; TOCTOU in JSP compile on case-insensitive FS allows uploaded file to execute as JSP.

Reporter	Title	Published	Views	Family All 347
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	20 Dec 202421:30	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	19 Dec 202402:43	–	githubexploit
GithubExploit	Exploit for CVE-2025-55752	29 Oct 202508:27	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	23 Dec 202414:11	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	25 Dec 202418:42	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	18 Dec 202419:53	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	30 Mar 202517:15	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	20 Jun 202616:07	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	20 Dec 202405:24	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat	21 Dec 202405:54	–	githubexploit

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2024-56337
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
lists	www.lists.apache.org/thread/b2b9qrgjrz1kvo4ym8y2wkfdvwoq6qbp
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-56337
cve	www.cve.org/CVERecord
cve	www.cve.org/CVERecord

30 Jun 2026 00:39Current

7.6High risk

Vulners AI Score7.6

CVSS 3.19.8

EPSS0.44312

SSVC