CVE-2025-24813

Published Mar 10, 2025

Last updated 4 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-24813 is a vulnerability affecting Apache Tomcat versions 9.0.0.M1 through 9.0.98, 10.1.0.M1 through 10.1.34, and 11.0.0.M1 through 11.0.2. It stems from an issue in how Tomcat handles partial PUT requests. Specifically, the vulnerability arises from the use of a temporary file based on user-supplied filenames and paths, where the path separator is replaced by a dot. This can potentially allow unauthorized access to sensitive files, injection of malicious content, or even remote code execution under certain conditions. Exploitation of this vulnerability requires a specific set of circumstances. For information disclosure or content injection, the default servlet must have write access enabled (it's disabled by default), partial PUT support must be enabled (which it is by default), and the target URL for sensitive uploads must be a subdirectory of a public upload URL. The attacker also needs to know the names of the sensitive files being uploaded via partial PUT. For remote code execution, the same conditions apply, with the addition of the application using Tomcat's file-based session persistence in the default location and including a library vulnerable to deserialization attacks.

Description
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.
Source
security@apache.org
NVD status
Analyzed

Risk scores

CVSS 3.1

Type
Primary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Known exploits

Data from CISA

Vulnerability name
Apache Tomcat Path Equivalence Vulnerability
Exploit added on
Apr 1, 2025
Exploit action due
Apr 22, 2025
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

security@apache.org
CWE-44
nvd@nist.gov
CWE-502

Social media

Hype score
Not currently trending
  1. 还原漏洞调用链:CVE-2025-24813 Tomcat 反序列化漏洞源码深度解析 攻击者可执行任意代码: 默认 Servlet 启用了写权 限默认禁用 启用了部分PUT请求支持 默认启用 应用程序使用 Tomcat 的基于文件的会话持久化(默

    @hackerkiki_6

    22 Jul 2025

    1431 Impressions

    0 Retweets

    33 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. This article delves into security risks posed by unpatched Apache Tomcat and Camel instances. We present an in-depth analysis of CVE-2025-24813 and CVE-2025-27636 and CVE-2025-29891 as well as findings from our telemetry (including exploit payloads). https://t.co/FogfF5t2xU https

    @Unit42_Intel

    15 Jul 2025

    4223 Impressions

    22 Retweets

    62 Likes

    14 Bookmarks

    0 Replies

    0 Quotes

  3. 【アーカイブ】 Tomcatに新たな脅威!早急な対策が必須です。 Apache Tomcatに深刻な脆弱性|CVE-2025-24813、米CISAが注意喚起 https://t.co/fADMZXC8lG #cybernote #ブログ仲間と繋がりたい #Webライター

    @CyberNote_media

    14 Jul 2025

    7 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. 【アーカイブ】 重要なセキュリティ情報です。早急な対応を! Apache Tomcatに深刻な脆弱性|CVE-2025-24813、米CISAが注意喚起 https://t.co/fADMZXCGbe #cybernote #ブログ仲間と繋がりたい #Webライター

    @CyberNote_media

    14 Jul 2025

    40 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. 【アーカイブ】 重要!Apache Tomcatの脆弱性にご注意ください。 Apache Tomcatに深刻な脆弱性|CVE-2025-24813、米CISAが注意喚起 https://t.co/fADMZXC8lG #cybernote #ブログ仲間と繋がりたい #Webライター

    @CyberNote_media

    10 Jul 2025

    39 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. 【脆弱性分析】Apacheが提供する主要製品に深刻な脆弱性が相次いで発見された。TomcatのCVE-2025-24813と、CamelのCVE-2025-27636、CVE-2025-29891の3つが2025年3月に公開され、いずれもリモートコード実行を可能にする。 Tom

    @nakajimeeee

    5 Jul 2025

    264 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. 🛡️ RCE flaws in Apache Tomcat (CVE-2025-24813) & Camel (CVE-2025-27636/29891) under active attack. 🚨 Exploits use partial PUT & header case tricks. 🔧 Patch now. Over 125K attempts detected. Read more: https://t.co/tO1iixhgQb #Apache #CVE2025 #CyberSecurity

    @threatsbank

    5 Jul 2025

    34 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. "Apache disclosed critical RCE bugs: CVE-2025-24813 in Tomcat, CVE-2025-27636 & CVE-2025-29891 in Camel. Millions of developers at risk. Patch ASAP."

    @Tudorel92659164

    4 Jul 2025

    21 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  9. Hello everyone, I and my dear buddy @soltanali0 spent our time to analysis the this CVE-2025-24813 yesterday and we've written it down , we decided share it with you –– coming soon

    @MrKlaus1337

    4 Jul 2025

    11 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  10. Hello everyone, today I and my dear buddy @soltanali0 spent our time to analysis the this CVE-2025-24813 and we've written down it , we decided share it with you –– coming soon

    @MrKlaus1337

    4 Jul 2025

    2 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  11. Apache Foundationは2025年、TomcatとCamelに重大な脆弱性が存在することを公表した。TomcatのCVE-2025-24813は、HTTP PUTリクエストを悪用し、セッション永続化が有効な環境でリモートコード実行を可能にする。

    @yousukezan

    3 Jul 2025

    819 Impressions

    0 Retweets

    3 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  12. Apache Tomcat bajo fuego: CVE-2025-24813 (RCE pre-auth vía partial PUT) ya observado en la wild. Parchéalo YA. 😉 #CVE2025 #ApacheTomcat #bugbountytips https://t.co/NYVv53pu9j

    @gorkaelbochi

    3 Jul 2025

    8 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  13. Critical vulnerabilities in Apache Tomcat (CVE-2025-24813) & Camel (CVE-2025-27636, CVE-2025-29891) exposed millions to remote code execution. Widespread scans and exploits highlight the urgent need for patches. 🚨 #SecurityAlert #OpenSource #UK https://t.co/Tp9rRTLiPD

    @TweetThreatNews

    3 Jul 2025

    19 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  14. 1/6 1/ 🚨 #Apache bajo ataque: Vulnerabilidades en Tomcat (Partial PUT CVE-2025-24813) y Camel (Header Hijack CVE-2025-27636) revelan riesgos críticos. Descubiertos recientemente, pueden ser explotados para comprometer sistemas. 🌐 Detalles: https://t.co/DlFPoXSyxT

    @x_sentinel99263

    3 Jul 2025

    13 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  15. 【アーカイブ】 重要なセキュリティ情報!対策はお早めに。 Apache Tomcatに深刻な脆弱性|CVE-2025-24813、米CISAが注意喚起 https://t.co/fADMZXC8lG #cybernote #ブログ仲間と繋がりたい #Webライター

    @CyberNote_media

    2 Jul 2025

    34 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  16. 🚨CVE-2025-24813: Apache Tomcat potential RCE and/or information disclosure and/or information corruption with partial PUT ZoomEye Link: https://t.co/IHs6PYm1JQ ZoomEye Dork: app="Apache Tomcat" Results: 815,431 Advisory: https://t.co/CxmqZXS3Sh PoC: https://t.co/ptDYkVO0

    @DarkWebInformer

    18 Jun 2025

    16599 Impressions

    77 Retweets

    265 Likes

    133 Bookmarks

    3 Replies

    0 Quotes

  17. Cybersecurity analysts detect ongoing brute-force campaigns targeting exposed Apache Tomcat Manager panels from hundreds of malicious IPs ✋. Strong authentication & timely patching are vital, especially after CVE-2025-24813. #Tomcat #Security #UK https://t.co/adbPF73uRj

    @TweetThreatNews

    11 Jun 2025

    66 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  18. #Vulnerability #apacheTomcat CISA Flags Apache Tomcat CVE-2025-24813 as Actively Exploited with 9.8 CVSS https://t.co/kQK83S8mE2

    @Komodosec

    6 Jun 2025

    24 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  19. ⚠️ New SOC Alert: Apache Tomcat Serialized Payload RCE CVE-2025-24813 is a critical Apache Tomcat RCE vulnerability caused by path equivalence in HTTP PUT handling, allowing attackers to upload malicious payloads and execute arbitrary code remotely. 🙍 Role: Incident ht

    @LetsDefendIO

    31 May 2025

    4917 Impressions

    12 Retweets

    85 Likes

    38 Bookmarks

    0 Replies

    1 Quote

  20. 『Arctera/Veritas Desktop Laptop Option versions: 9.7, 9.8, 9.8.1, 9.8.2, 9.8.3 and 9.9. Earlier unsupported versions may be affected as well.』 CVE-2024-38475 CVE-2025-24813 Desktop Laptop Option (DLO) Apache HTTP Server and Tomcat Vulnerabilities https://t.co/epylioiFMb

    @autumn_good_35

    29 May 2025

    255 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  21. به تازگی برای وب سرور apache Tomcat آسیب پذیری با کد شناسایی CVE-2025-24813 از نوع RCE و با نمره آسیب پذیری 9.9 منتشر شده است. اکسپلویت این آسیب پذیری با استفاده از متد put بو

    @AmirHossein_sec

    27 May 2025

    46 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  22. Apache Tomcatに重大なRCE脆弱性(CVE-2025-24813)が発見され、PoCも公開済み。特定の非デフォルト設定下で悪用可能。速やかなアップデートと設定の見直しが推奨される。 https://t.co/uKSrbV4PAW

    @01ra66it

    26 May 2025

    5688 Impressions

    35 Retweets

    82 Likes

    28 Bookmarks

    0 Replies

    2 Quotes

  23. CVE-2025-24813: Path Equivalence: 'https://t.co/65d0g2MyZk' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat:

    @cyber_advising

    25 May 2025

    924 Impressions

    2 Retweets

    7 Likes

    1 Bookmark

    0 Replies

    1 Quote

  24. Actively exploited CVE : CVE-2025-24813

    @transilienceai

    15 May 2025

    17 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  25. 🚨 The first post of my new blog "Exploring CVE-2025-24813: Remote Code Execution via Tomcat Session Deserialization" is now live! https://t.co/51tvcG0nlq

    @devoo1337

    12 May 2025

    1094 Impressions

    6 Retweets

    24 Likes

    11 Bookmarks

    0 Replies

    1 Quote

  26. Apache Tomcat の脆弱性 CVE-2025-31650/31651 が FIX:DoS とルール・バイパスの恐れ https://t.co/qd4baOiT2c Apache Tomcat に新たな脆弱性が発見されました。なお、同ツールでは、3月以降から別の脆弱性 CVE-2025-24813 の悪用が

    @iototsecnews

    12 May 2025

    289 Impressions

    1 Retweet

    0 Likes

    0 Bookmarks

    0 Replies

    1 Quote

  27. 🛡️アウトブレイクアラート🛡️ 👉Apache Tomcat RCE CVE-2025-24813はApache Tomcatのpartial PUT機能の認証されていないリモートコード実行の脆弱性です。 脆弱性のエクスプロイトコードは一般入手可能で、攻撃の開

    @FortinetJapan

    1 May 2025

    264 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  28. Critical Apache Tomcat flaw (CVE-2025-24813) actively exploited! Hackers bypass rules & execute code. Forget patching or WAFs—WEBOUNCER by https://t.co/YvUrFmPcXS is the ultimate web app security solution. No upgrades needed, unmatched protection. #impenetrable #Cybersecuri

    @BrainLabVisions

    29 Apr 2025

    39 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    1 Quote

  29. CVE-2025-24813: Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet https://t.co/NxlZbJZ9dt #bugbounty #bugbountytips #bugbountytip

    @bountywriteups

    27 Apr 2025

    32 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  30. ⚡ CVE-2025-24813: Remote Code Execution and/or Information disclosure and/or malicious content adde... 👨🏻‍💻 sw0rd1ight ➟ Internet Bug Bounty 🟥 High 💰 $4,323 🔗 https://t.co/N5uSAw7XOJ #bugbounty #bugbountytips #cybersecurity #infosec https://t.co/Yufoz6L9

    @h1Disclosed

    27 Apr 2025

    1276 Impressions

    5 Retweets

    28 Likes

    10 Bookmarks

    0 Replies

    0 Quotes

  31. 2025 Bug Bounties! Hunt: CVE-2025-30406: Gladinet key CVE-2025-29824: Windows EoP CVE-2025-24054: NTLM theft CVE-2025-24813: Tomcat bug CVE-2025-32433: SSH RCE Burp, Amass. Big bounties! Get Bug Bounty Guide 2025! #BugBounty #VulnHunting2025 https://t.co/tin4q4LnYa

    @Viper_Droidd

    21 Apr 2025

    23 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  32. Apache Tomcat CVE-2025-24813 brings RCE concerns. Key points: • Patches available—upgrade if you can. • Most setups are secure unless misconfigured. • Claims of active exploitation may be overstated. Stay updated by subscribing to our blog: https://t.co/0CR2oUy2R9 https://t

    @behkfox

    21 Apr 2025

    34 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  33. Critical Alert: A severe RCE vulnerability (CVE-2025-24813) has been identified in Apache Tomcat, capable of allowing unauthorized remote code execution. Affected versions range from 11.0.0-M1 to 11.0.2, 10.1.0-M1 to 10.1.34, and 9.0.0.M1 to 9.0.98. https://t.co/ppcp1xs5gh

    @The4n6Analyst

    21 Apr 2025

    32 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  34. Actively exploited CVE : CVE-2025-24813

    @transilienceai

    16 Apr 2025

    17 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  35. Read about observed attack traffic, detections, and mitigations for the path equivalence vulnerability in Apache Tomcat (CVE-2025-24813). Learn more. @Akamai #AkamaiSecurity https://t.co/L82vzIXGBh https://t.co/0uEcG2Tkdb

    @Yanivzadok

    14 Apr 2025

    39 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  36. Top 5 Trending CVEs: 1 - CVE-2021-35587 2 - CVE-2025-30406 3 - CVE-2023-43622 4 - CVE-2025-24813 5 - CVE-2025-3248 #cve #cvetrends #cveshield #cybersecurity https://t.co/4Fua3CAN6W

    @CVEShield

    13 Apr 2025

    13 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  37. CVE-2025-24813 is a critical security issue that affects Apache Tomcat versions from 9.0.0.M1 to 11.0.2. It allows remote code execution, information disclosure and malicious content injection https://t.co/9qnrIMKfHD

    @cyber_advising

    11 Apr 2025

    6262 Impressions

    41 Retweets

    147 Likes

    75 Bookmarks

    1 Reply

    0 Quotes

  38. احذر #RCE وتسرب المعلومات! ثغرة #Apache Tomcat CVE-2025-24813! تحقق من مدونة https://t.co/gKKiwWrA0u للحصول على التفاصيل! ☑️الإصدارات المعرضة للثغرة ☑️شروط الهجوم ☑️اكتشاف خادم Apache Tomcat ☑️كيفية الاستجابة للحصول على تحليل فني كامل وكيفية الاستجابة: https://t.co/AAwEJVcWez h

    @CriminalIP_AR

    10 Apr 2025

    40 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  39. 米当局は、Apache Tomcatの脆弱性「CVE-2025-24813」が悪用されていると警告。リモートコード実行が可能で、4月1日に「悪用が確認された脆弱性カタログ」に追加された。開発チームは3月に修正を公開、WAFでの検出回避の可能性もあり注意が呼びかけられている。

    @karukaruit

    8 Apr 2025

    41 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  40. 🚨 Se detecta PoC activa explotando RCE en Apache Tomcat (CVE-2025-24813) https://t.co/ncil3Vbl7E

    @tpx_Security

    7 Apr 2025

    231 Impressions

    3 Retweets

    3 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  41. Actively exploited CVE : CVE-2025-24813

    @transilienceai

    6 Apr 2025

    22 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  42. ''Apache Tomcat CVE-2025-24813: What You Need to Know | Rapid7 Blog'' #infosec #pentest #redteam #blueteam https://t.co/uWBoxEmcKi

    @CyberWarship

    6 Apr 2025

    3264 Impressions

    11 Retweets

    48 Likes

    19 Bookmarks

    1 Reply

    0 Quotes

  43. Actively exploited CVE : CVE-2025-24813

    @transilienceai

    6 Apr 2025

    18 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  44. 2. Contexto de Ameaças em Projetos Apache: - Vulnerabilidades em projetos Apache são alvos frequentes. Exemplo recente: CVE-2025-24813 no Tomcat (CVSS 9.8), explorado em 30 horas após divulgação.

    @pedroco53915492

    5 Apr 2025

    13 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  45. Apache Tomcat: Potential RCE Severity : Critical CVE-2025-24813 Exploit : https://t.co/6ggKgBQrYu Refrence : https://t.co/6gGeOYAdAp #ApacheTomcat #bugbounty #RCE https://t.co/m34WUgLFqv

    @wgujjer11

    5 Apr 2025

    12275 Impressions

    83 Retweets

    352 Likes

    212 Bookmarks

    2 Replies

    0 Quotes

  46. Actively exploited CVE : CVE-2025-24813

    @transilienceai

    4 Apr 2025

    13 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  47. Read about observed attack traffic, detections, and mitigations for the path equivalence vulnerability in Apache Tomcat (CVE-2025-24813). Learn more. @Akamai #AkamaiSecurity https://t.co/YkIdevDmBC https://t.co/xy8qFC27xK

    @epichol

    3 Apr 2025

    24 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  48. Actively exploited CVE : CVE-2025-24813

    @transilienceai

    3 Apr 2025

    17 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  49. Apache Tomcatに深刻な脆弱性|CVE-2025-24813、米CISAが注意喚起 #cybernote #ブログ仲間と繋がりたい #Webライター https://t.co/oBqikaW4Tc

    @Teeeda_worker

    3 Apr 2025

    34 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  50. Apache Tomcatに深刻な脆弱性|CVE-2025-24813、米CISAが注意喚起 #cybernote #ブログ仲間と繋がりたい #Webライター https://t.co/m8AfDzhwCG

    @CyberNote_media

    3 Apr 2025

    4 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations