CVE-2024-50379
CRITICAL 9.8EPSS 44.3%
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
- CVSS v4.0
- 7.2 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - CVSS v3.1
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 44.31% chance of exploitation in the next 30 days, 99th percentile
- Published
- 2024-12-17
- Updated
- 2025-11-03
Proof-of-concept exploits (15)
- Alchemist3dot14/CVE-2024-503791★ · 2024-12-20
- Erosion2020/JavaSec71★ · 2026-03-31
- SleepingBag945/CVE-2024-5037984★ · 2024-12-23
- ZapcoMan/TomcatVulnToolkit10★ · 2025-11-02
- dear-cell/CVE-2024-503791★ · 2024-12-23
- dkstar11q/CVE-2024-50379-nuclei0★ · 2024-12-25
- dragonked2/CVE-2024-50379-POC4★ · 2024-12-25
- gomtaengi/CVE-2024-50379-exp1★ · 2024-12-26
- iSee857/CVE-2024-50379-PoC23★ · 2025-04-01
- ph0ebus/Tomcat-CVE-2024-50379-Poc58★ · 2024-12-21
- pwnosec/CVE-2024-503792★ · 2025-01-23
- thunww/CVE-2024-503790★ · 2025-04-13
- v3153/CVE-2024-50379-POC4★ · 2024-12-26
- yiliufeng168/CVE-2024-50379-POC1★ · 2024-12-18
- Lux-J/CVE-2024-50379-exp