CVE-2024-52318 Apache Tomcat: Incorrect JSP tag recycling leads to XSS
Incorrect JSP tag recycling in Apache Tomcat allows attackers to execute arbitrary scripts in user browsers via Cross-Site Scripting.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-52318?
CVE-2024-52318 is a medium-severity cross-site scripting vulnerability in Apache Tomcat, published on 18 Nov 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Incorrect object recycling and reuse vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96.
Users are recommended to upgrade to version 11.0.1, 10.1.32 or 9.0.97, which fixes the issue.
Weakness: CWE-326
Which versions are affected by CVE-2024-52318?
19 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-jasper, tomcat and org.apache.tomcat:tomcat. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat.embed:tomcat-embed-jasper Maven | From 10.1.31 | 10.1.32 |
org.apache.tomcat.embed:tomcat-embed-jasper Maven | From 10.1.31 | 10.1.32 |
org.apache.tomcat.embed:tomcat-embed-jasper Maven | From 11.0.0 | 11.0.1 |
org.apache.tomcat.embed:tomcat-embed-jasper Maven | From 11.0.0 | 11.0.1 |
org.apache.tomcat.embed:tomcat-embed-jasper Maven | From 9.0.96 | 9.0.97 |
org.apache.tomcat.embed:tomcat-embed-jasper Maven | From 9.0.96 | 9.0.97 |
13 more packages
tomcat Bitnami | From 9.0.96 | 9.0.97, 10.1.33, 11.0.9 |
org.apache.tomcat:tomcat Maven | From 10.1.31 | 10.1.32 |
org.apache.tomcat:tomcat Maven | From 10.1.31 | 10.1.32 |
org.apache.tomcat:tomcat Maven | From 11.0.0 | 11.0.1 |
org.apache.tomcat:tomcat Maven | From 11.0.0 | 11.0.1 |
org.apache.tomcat:tomcat Maven | From 9.0.96 | 9.0.97 |
org.apache.tomcat:tomcat Maven | From 9.0.96 | 9.0.97 |
org.apache.tomcat:tomcat-jasper Maven | From 10.1.31 | 10.1.32 |
org.apache.tomcat:tomcat-jasper Maven | From 10.1.31 | 10.1.32 |
org.apache.tomcat:tomcat-jasper Maven | From 11.0.0 | 11.0.1 |
org.apache.tomcat:tomcat-jasper Maven | From 11.0.0 | 11.0.1 |
org.apache.tomcat:tomcat-jasper Maven | From 9.0.96 | 9.0.97 |
org.apache.tomcat:tomcat-jasper Maven | From 9.0.96 | 9.0.97 |
Products include Apache Tomcat.
How do I fix CVE-2024-52318?
Upgrade org.apache.tomcat.embed:tomcat-embed-jasper to a fixed version for your release line: 10.1.32, 11.0.1 or 9.0.97.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-52318 being exploited?
There is no known exploitation of CVE-2024-52318 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Apache Tomcat
Sources
Also known as BIT-tomcat-2024-52318, DEBIAN-CVE-2024-52318, GHSA-f632-9449-3j4w, OESA-2024-2461, OESA-2024-2462, OESA-2024-2463 and 1 more.