CVE-2024-52318

Apache Tomcat: Incorrect JSP tag recycling leads to XSS

Incorrect object recycling and reuse vulnerability in Apache Tomcat.This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96.Users are recommended to upgrade to version 11.0.1, 10.1.32 or 9.0.97, which fixes the issue.

Affected

Apache Software Foundation · Apache Tomcat

CVSS v3.1 CNA

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

1.74% chance of exploitation in the next 30 days, 77th percentile

Published

2024-11-18

Updated

2025-01-31

Proof-of-concept exploits (1)

• TAM-K592/CVE-2024-523180★ · 2024-11-21

Security advisories

• https://lists.apache.org/thread/co243cw1nlh6p521c5265cm839wkqdp9
• https://security.netapp.com/advisory/ntap-20250131-0009
• advisories/GHSA-f632-9449-3j4w

References

• CVE Record
• NVD entry

Related

• CVE-2024-40725
• CVE-2024-40898
• CVE-2024-4577
• CVE-2024-52316
• CVE-2024-52317
• CVE-2024-53677