CVE-2021-24122

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-24122
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-24122.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-24122
Aliases
Downstream
Related
Published
2021-01-14T15:15:13.400Z
Modified
2026-07-08T06:03:28.541965085Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "9.0"
                },
                {
                    "last_affected": "9.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "debian:debian_linux",
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ]
        },
        {
            "extracted_events": [
                {
                    "introduced": "9.3.3"
                },
                {
                    "last_affected": "9.3.3"
                },
                {
                    "introduced": "9.3.6"
                },
                {
                    "last_affected": "9.3.6"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:agile_plm",
            "cpes": [
                "cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*"
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
e498667bd7811e846771a852b16ce9f1e524b81b
Last affected
c5d9010a75e99a69f59ba11cc1116d039a113979
Introduced
e37b977db6f47e4380ad67114a49e8568951c953
Last affected
c042ec71219dbde3e1ce0381ce5be0801120d0fa
Introduced
3c78e95e36268dfb76db1570f0cf49104fa6eabc
Last affected
6989c4e9360b4f9443862968c15a95d17f264321
Introduced
29b07def810d335012e738b22ab44d4e232b50d1
Last affected
6f143d19d151620cd0bfe9ec2ffa429e36ad0e45
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.0.0:milestone8:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.0.0:milestone9:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "7.0.0"
        },
        {
            "last_affected": "7.0.106"
        },
        {
            "introduced": "8.5.0"
        },
        {
            "last_affected": "8.5.59"
        },
        {
            "introduced": "9.0.1"
        },
        {
            "last_affected": "9.0.39"
        },
        {
            "introduced": "9.0.0-milestone1"
        },
        {
            "last_affected": "9.0.0-milestone1"
        },
        {
            "introduced": "9.0.0-milestone10"
        },
        {
            "last_affected": "9.0.0-milestone10"
        },
        {
            "introduced": "9.0.0-milestone11"
        },
        {
            "last_affected": "9.0.0-milestone11"
        },
        {
            "introduced": "9.0.0-milestone12"
        },
        {
            "last_affected": "9.0.0-milestone12"
        },
        {
            "introduced": "9.0.0-milestone13"
        },
        {
            "last_affected": "9.0.0-milestone13"
        },
        {
            "introduced": "9.0.0-milestone14"
        },
        {
            "last_affected": "9.0.0-milestone14"
        },
        {
            "introduced": "9.0.0-milestone15"
        },
        {
            "last_affected": "9.0.0-milestone15"
        },
        {
            "introduced": "9.0.0-milestone16"
        },
        {
            "last_affected": "9.0.0-milestone16"
        },
        {
            "introduced": "9.0.0-milestone17"
        },
        {
            "last_affected": "9.0.0-milestone17"
        },
        {
            "introduced": "9.0.0-milestone18"
        },
        {
            "last_affected": "9.0.0-milestone18"
        },
        {
            "introduced": "9.0.0-milestone19"
        },
        {
            "last_affected": "9.0.0-milestone19"
        },
        {
            "introduced": "9.0.0-milestone2"
        },
        {
            "last_affected": "9.0.0-milestone2"
        },
        {
            "introduced": "9.0.0-milestone20"
        },
        {
            "last_affected": "9.0.0-milestone20"
        },
        {
            "introduced": "9.0.0-milestone21"
        },
        {
            "last_affected": "9.0.0-milestone21"
        },
        {
            "introduced": "9.0.0-milestone22"
        },
        {
            "last_affected": "9.0.0-milestone22"
        },
        {
            "introduced": "9.0.0-milestone23"
        },
        {
            "last_affected": "9.0.0-milestone23"
        },
        {
            "introduced": "9.0.0-milestone24"
        },
        {
            "last_affected": "9.0.0-milestone24"
        },
        {
            "introduced": "9.0.0-milestone25"
        },
        {
            "last_affected": "9.0.0-milestone25"
        },
        {
            "introduced": "9.0.0-milestone26"
        },
        {
            "last_affected": "9.0.0-milestone26"
        },
        {
            "introduced": "9.0.0-milestone27"
        },
        {
            "last_affected": "9.0.0-milestone27"
        },
        {
            "introduced": "9.0.0-milestone3"
        },
        {
            "last_affected": "9.0.0-milestone3"
        },
        {
            "introduced": "9.0.0-milestone4"
        },
        {
            "last_affected": "9.0.0-milestone4"
        },
        {
            "introduced": "9.0.0-milestone5"
        },
        {
            "last_affected": "9.0.0-milestone5"
        },
        {
            "introduced": "9.0.0-milestone6"
        },
        {
            "last_affected": "9.0.0-milestone6"
        },
        {
            "introduced": "9.0.0-milestone7"
        },
        {
            "last_affected": "9.0.0-milestone7"
        },
        {
            "introduced": "9.0.0-milestone8"
        },
        {
            "last_affected": "9.0.0-milestone8"
        },
        {
            "introduced": "9.0.0-milestone9"
        },
        {
            "last_affected": "9.0.0-milestone9"
        },
        {
            "introduced": "10.0.0-milestone1"
        },
        {
            "last_affected": "10.0.0-milestone1"
        },
        {
            "introduced": "10.0.0-milestone2"
        },
        {
            "last_affected": "10.0.0-milestone2"
        },
        {
            "introduced": "10.0.0-milestone3"
        },
        {
            "last_affected": "10.0.0-milestone3"
        },
        {
            "introduced": "10.0.0-milestone4"
        },
        {
            "last_affected": "10.0.0-milestone4"
        },
        {
            "introduced": "10.0.0-milestone5"
        },
        {
            "last_affected": "10.0.0-milestone5"
        },
        {
            "introduced": "10.0.0-milestone6"
        },
        {
            "last_affected": "10.0.0-milestone6"
        },
        {
            "introduced": "10.0.0-milestone7"
        },
        {
            "last_affected": "10.0.0-milestone7"
        },
        {
            "introduced": "10.0.0-milestone8"
        },
        {
            "last_affected": "10.0.0-milestone8"
        },
        {
            "introduced": "10.0.0-milestone9"
        },
        {
            "last_affected": "10.0.0-milestone9"
        }
    ]
}

Affected versions

10.*
10.0.0-milestone1
10.0.0-milestone2
10.0.0-milestone3
10.0.0-milestone4
10.0.0-milestone5
10.0.0-milestone6
10.0.0-milestone7
10.0.0-milestone8
10.0.0-milestone9
9.*
9.0.0-milestone1
9.0.0-milestone10
9.0.0-milestone11
9.0.0-milestone12
9.0.0-milestone13
9.0.0-milestone14
9.0.0-milestone15
9.0.0-milestone16
9.0.0-milestone17
9.0.0-milestone18
9.0.0-milestone19
9.0.0-milestone2
9.0.0-milestone20
9.0.0-milestone21
9.0.0-milestone22
9.0.0-milestone23
9.0.0-milestone24
9.0.0-milestone25
9.0.0-milestone26
9.0.0-milestone27
9.0.0-milestone3
9.0.0-milestone4
9.0.0-milestone5
9.0.0-milestone6
9.0.0-milestone7
9.0.0-milestone8
9.0.0-milestone9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-24122.json"