CVE: 2021-24122 found in tomcat-embed-core - Version: 9.0.36 [JAVA]

[Rajkumarr77]

Veracode Software Composition Analysis

Attribute	Details
Library	tomcat-embed-core
Description	Core Tomcat implementation
Language	JAVA
Vulnerability	Information Disclosure
Vulnerability description	apache tomcat is vulnerable to information disclosure. Security constraints can be bypassed to obtain and view JSP source code in certain configurations, when serving resources from a network location using the NTFS file system. The vulnerability is caused by the insufficient validation for the : character in the file path.
CVE	2021-24122
CVSS score	4.3
Vulnerability present in version/s	9.0.0.M1-9.0.39
Found library version/s	9.0.36
Vulnerability fixed in version	9.0.40
Library latest version	11.0.9
Fix

Links:

• https://sca.analysiscenter.veracode.com/vulnerability-database/libraries/1334?version=9.0.36
• https://sca.analysiscenter.veracode.com/vulnerability-database/vulnerabilities/29014
• Patch: apache/tomcat@935fc55