CVE-2021-24122: Information Disclosure in Apache Tomcat
Summary
CVE-2021-24122: Information Disclosure in Apache Tomcat. Affects org.apache.tomcat.embed:tomcat-embed-core across 4 version ranges.
>= 7.0.0, < 7.0.107
>= 8.5.0, < 8.5.60
>= 9.0.0, < 9.0.40
>= 10.0.0-M1, < 10.0.0-M10
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
The same CVE-2021-24122 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications. The vulnerability identified as CVE-2021-24122 affects Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59, and 7.0.0 to 7.0.106. This vulnerability allows for the disclosure of JSP source code in certain configurations when serving resources from a network location using the NTFS file system. The root cause of this vulnerability is the unexpected behavior of the JRE API File.getCanonicalPath(), which is caused by the inconsistent behavior of the Windows API (FindFirstFileW) in specific circumstances.
Vulnerability Detail
The vulnerability in Apache Tomcat allows an attacker to access and disclose JSP source code in certain configurations. This can lead to the exposure of sensitive information, including credentials, database connection details, and other proprietary code. The vulnerability is considered moderate with a CVSS score of 5.9. It is important to note that this vulnerability only affects specific versions of Apache Tomcat and when serving resources from a network location using the NTFS file system.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.0.1077.0.107 -
>= 8.5.0, < 8.5.608.5.60 -
>= 9.0.0, < 9.0.409.0.40 -
>= 10.0.0-M1, < 10.0.0-M1010.0.0-M10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability identified as CVE-2021-24122 in Apache Tomcat allows for the disclosure of JSP source code in certain configurations. It is important to update to the fixed versions of Apache Tomcat to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for org.apache.tomcat.embed:tomcat-embed-core →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications.
The vulnerability affects Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59, and 7.0.0 to 7.0.106.
This vulnerability allows for the disclosure of JSP source code in certain configurations, potentially exposing sensitive information such as credentials and proprietary code.
The CVSS score of this vulnerability is 5.9, which indicates a moderate severity level.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Apache Tomcat as mentioned in the 'how_to_fix' section.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat.embed:tomcat-embed-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
