Improper Authentication in Apache Tomcat - CVE-2024-52316

Vulnerability identifier: #VU100588

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-52316

CWE-ID: CWE-287

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error when processing authentication requests. If Tomcat was configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not have failed, allowing the user to bypass the authentication process.

Apache Tomcat
JBoss Web Server
Debian Linux
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise High Performance Computing 15 SP2
SUSE Linux Enterprise Server 15 SP2
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Manager Server
SUSE Enterprise Storage
Web and Scripting Module
openSUSE Leap
Anolis OS
Ubuntu
IBM Cloud Pak for Security
IBM Process Mining
EasyApache
Crowd Data Center
IBM UrbanCode Release
IBM Rational Build Forge
NetWorker
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Integration Bus
Dell EMC OpenManage Server Administrator
QRadar Suite
IBM Security SOAR
Cloud Pak for Network Automation
Cloudera Observability with IBM
DevOps
IBM Business Automation Manager Open Editions
CICS Transaction Gateway Desktop Edition
CICS Transaction Gateway for Multiplatforms
webMethods developer portal
ApplinX
Storage Copy Data Management
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
IBM QRadar Incident Forensics
Storage Protect Plus Server
Traffix SDC
Crowd Server
Dell EMC VxRail Appliance
Cloudera Data Platform Private Cloud Base for IBM
Web Help Desk
Oracle Hospitality Cruise Shipboard Property Management System
SAP Commerce Cloud
watsonx.data
IBM Qradar SIEM
tomcat-admin-webapps
tomcat-lib
tomcat
tomcat-webapps
tomcat-jsp-2_3-api
tomcat-javadoc
tomcat-docs-webapp
tomcat-el-3_0-api
tomcat-servlet-4_0-api
tomcat-doc
tomcat-el-3.0-api
tomcat-jsp-2.3-api
tomcat-servlet-4.0-api
tomcat-jsvc
tomcat-embed
tomcat10 (Ubuntu package)
tomcat10-servlet-6_0-api
tomcat10-docs-webapp
tomcat10-lib
tomcat10-jsvc
tomcat10-jsp-3_1-api
tomcat10-el-5_0-api
tomcat10
tomcat10-webapps
tomcat10-admin-webapps
tomcat10-embed
tomcat10-doc
tomcat10 (Debian package)

Install updates from vendor's website.

Apache Tomcat - addressed in versions 9.0.96, 10.1.31, 11.0.0
IBM Cloud Pak for Security - update to 1.11.3.0
QRadar Suite - update to 1.11.3.0
IBM Process Mining - update to 2.0
Cloud Pak for Network Automation - update to 2.7.8
Cloudera Observability with IBM - update to 3.6.2
EasyApache - update to 4 2024-11-20
Crowd Server - addressed in versions 6.0.7, 6.1.4, 6.2.2
Crowd Data Center - addressed in versions 6.0.7, 6.1.4, 6.2.2
DevOps - update to 7.0.0.4
Dell EMC VxRail Appliance - addressed in versions 7.0.533, 8.320, 8.321
IBM Rational Build Forge - update to 8.0.0.28
IBM Business Automation Manager Open Editions - update to 8.0.8
webMethods developer portal - update to 11.1.6
Web Help Desk - update to 12.8.4
NetWorker - update to 19.13.0.1
watsonx.data - update to 2.1.1
Storage Copy Data Management - update to 2.2.26.0
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.0
watsonx Assistant Cartridge - update to 5.1.1
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.1
JBoss Web Server - update to 6.1.0
IBM Qradar SIEM - update to 7.5.0 Update Pack 10 IF02
IBM QRadar Incident Forensics - update to 7.5.0 UP10 IF02
tomcat-admin-webapps - addressed in versions 9.0.36-3.133.1, 9.0.97-150200.71.1
tomcat-lib - addressed in versions 9.0.36-3.133.1, 9.0.97-150200.71.1
tomcat - addressed in versions 9.0.36-3.133.1, 9.0.97-150200.71.1
tomcat-webapps - addressed in versions 9.0.36-3.133.1, 9.0.97-150200.71.1
tomcat-jsp-2_3-api - addressed in versions 9.0.36-3.133.1, 9.0.97-150200.71.1
tomcat-javadoc - addressed in versions 9.0.36-3.133.1, 9.0.97-150200.71.1
tomcat-docs-webapp - addressed in versions 9.0.36-3.133.1, 9.0.97-150200.71.1
tomcat-el-3_0-api - addressed in versions 9.0.36-3.133.1, 9.0.97-150200.71.1
tomcat-servlet-4_0-api - addressed in versions 9.0.36-3.133.1, 9.0.97-150200.71.1
tomcat - update to 9.0.96-1
tomcat-webapps - update to 9.0.96-1
tomcat-admin-webapps - update to 9.0.96-1
tomcat-doc - update to 9.0.96-1
tomcat-docs-webapp - update to 9.0.96-1
tomcat-el-3.0-api - update to 9.0.96-1
tomcat-jsp-2.3-api - update to 9.0.96-1
tomcat-lib - update to 9.0.96-1
tomcat-servlet-4.0-api - update to 9.0.96-1
tomcat-jsvc - update to 9.0.97-150200.71.1
tomcat-embed - update to 9.0.97-150200.71.1
IBM Integration Bus - update to 10.1.0.5
tomcat10 (Ubuntu package) - addressed in versions 10.1.16-1ubuntu0.1~esm3, 10.1.35-1ubuntu0.1
Storage Protect Plus Server - update to 10.1.18
tomcat10-servlet-6_0-api - update to 10.1.33-150200.5.28.1
tomcat10-docs-webapp - update to 10.1.33-150200.5.28.1
tomcat10-lib - update to 10.1.33-150200.5.28.1
tomcat10-jsvc - update to 10.1.33-150200.5.28.1
tomcat10-jsp-3_1-api - update to 10.1.33-150200.5.28.1
tomcat10-el-5_0-api - update to 10.1.33-150200.5.28.1
tomcat10 - update to 10.1.33-150200.5.28.1
tomcat10-webapps - update to 10.1.33-150200.5.28.1
tomcat10-admin-webapps - update to 10.1.33-150200.5.28.1
tomcat10-embed - update to 10.1.33-150200.5.28.1
tomcat10-doc - update to 10.1.33-150200.5.28.1
tomcat10 (Debian package) - update to 10.1.34-0+deb12u1
Dell EMC OpenManage Server Administrator - update to 11.1.0.0
IBM Security SOAR - update to 51.0.4.1

• https://tomcat.apache.org/security-9.html
• https://tomcat.apache.org/security-10.html
• https://tomcat.apache.org/security-11.html

• Multiple vulnerabilities in Apache Tomcat
• Multiple vulnerabilities in cPanel EasyApache
• SUSE update for tomcat
• SUSE update for tomcat
• SUSE update for tomcat10
• Multiple vulnerabilities in SolarWinds Web Help Desk
• Multiple vulnerabilities in IBM QRadar SIEM
• Dell OpenManage Server Administrator (OMSA) update for Apache Tomcat
• Multiple vulnerabilities in IBM Security SOAR
• IBM ApplinX update for Apache Tomcat
• Multiple vulnerabilities in IBM Integration Bus
• Debian update for tomcat10
• Authorization bypass in Traffix SDC Apache Tomcat component
• Multiple vulnerabilities in IBM Watson Discovery for IBM Cloud Pak for Data
• Crowd Data Center and Server update for tomcat-catalina
• Multiple vulnerabilities in IBM watsonx.data
• SAP Commerce Cloud update for Apache Tomcat
• Multiple vulnerabilities in IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
• Anolis OS update for tomcat
• Multiple vulnerabilities in Dell VxRail Appliance
• Multiple vulnerabilities in Dell VxRail Appliance 7.x
• Dell VxRail Appliance 8.x update for third-party components
• Multiple vulnerabilities in Oracle Hospitality Cruise Shipboard Property Management System
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in IBM Storage Copy Data Management
• Multiple vulnerabilities in IBM Cloud Pak for Security and IBM QRadar Suite Software
• Multiple vulnerabilities in IBM DevOps Release
• Multiple vulnerabilities in IBM Rational Build Forge
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Ubuntu update for tomcat10
• Dell NetWorker update for Apache Tomcat
• Multiple vulnerabilities in IBM webMethods developer portal
• Multiple vulnerabilities in Cloudera Observability on Premises with IBM
• Multiple vulnerabilities in Red Hat JBoss Web Server
• Multiple vulnerabilities in IBM Storage Protect Plus Server
• Multiple vulnerabilities in IBM Cloudera Data Platform Private Cloud Base with IBM (CDP)
• Multiple vulnerabilities in IBM CICS Transaction Gateway for Multiplatforms
• Multiple vulnerabilities in CICS Transaction Gateway Desktop Edition