{"id":"CVE-2021-24122","aliases":["BIT-tomcat-2021-24122","GHSA-2rvv-w9r2-rg7m"],"url":"https://o3.security/vulnerability/CVE-2021-24122","summary":"Information Disclosure in Apache Tomcat","details":"When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.","published":"2021-01-14T15:15:13.400Z","modified":"2026-10-10T02:30:22.740341769Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Maven","name":"org.apache.tomcat.embed:tomcat-embed-core","fixedVersion":"10.0.0-M10"},{"ecosystem":"Maven","name":"org.apache.tomcat.embed:tomcat-embed-core","fixedVersion":"9.0.40"},{"ecosystem":"Maven","name":"org.apache.tomcat.embed:tomcat-embed-core","fixedVersion":"8.5.60"},{"ecosystem":"Maven","name":"org.apache.tomcat.embed:tomcat-embed-core","fixedVersion":"7.0.107"}],"fix":{"url":"https://github.com/apache/tomcat/commit/7f004ac4531c45f9a2a2d1470561fe135cf27bc2","label":"apache/tomcat@7f004ac"},"references":[{"type":"WEB","url":"https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r7382e1e35b9bc7c8f320b90ad77e74c13172d08034e20c18000fe710%40%3Cdev.tomee.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r776c64337495bf28b7d5597268114a888e3fad6045c40a0da0c66d4d%40%3Cdev.tomee.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r7e0bb9ea415724550e2b325e143b23e269579e54d66fcd7754bd0c20%40%3Cdev.tomcat.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rb32a73b7cb919d4f44a2596b6b951274c0004fc8b0e393d6829a45f9%40%3Cusers.tomcat.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937%40%3Cdev.tomcat.apache.org%3E"},{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2021/01/14/1"},{"type":"ADVISORY","url":"https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20210212-0008/"},{"type":"ADVISORY","url":"https://www.oracle.com//security-alerts/cpujul2021.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-24122"},{"type":"WEB","url":"https://github.com/apache/tomcat/commit/7f004ac4531c45f9a2a2d1470561fe135cf27bc2"},{"type":"WEB","url":"https://github.com/apache/tomcat/commit/800b03140e640f8892f27021e681645e8e320177"},{"type":"WEB","url":"https://github.com/apache/tomcat/commit/920dddbdb981f92e8d5872a4bb126a10af5ca8a9"},{"type":"WEB","url":"https://github.com/apache/tomcat/commit/935fc5582dc25ae10bab6f9d5629ff8d996cb533"},{"type":"WEB","url":"https://tomcat.apache.org/security-9.html"},{"type":"WEB","url":"https://tomcat.apache.org/security-8.html"},{"type":"WEB","url":"https://tomcat.apache.org/security-7.html"},{"type":"WEB","url":"https://tomcat.apache.org/security-10.html"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20210212-0008"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937@%3Cdev.tomcat.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rb32a73b7cb919d4f44a2596b6b951274c0004fc8b0e393d6829a45f9@%3Cusers.tomcat.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r7e0bb9ea415724550e2b325e143b23e269579e54d66fcd7754bd0c20@%3Cdev.tomcat.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r776c64337495bf28b7d5597268114a888e3fad6045c40a0da0c66d4d@%3Cdev.tomee.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r7382e1e35b9bc7c8f320b90ad77e74c13172d08034e20c18000fe710@%3Cdev.tomee.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52@%3Cannounce.tomcat.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52@%3Cannounce.apache.org%3E"},{"type":"PACKAGE","url":"https://github.com/apache/tomcat"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-10T02:30:22.740341769Z"}}