CVE-2024-46544

Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration which may lead to information disclosure and/or denial of service.

This issue affects Apache Tomcat Connectors: from 1.2.9-beta through 1.2.49. Only modjk on Unix like systems is affected. Neither the ISAPI redirector nor modjk on Windows is affected.

Users are recommended to upgrade to version 1.2.50, which fixes the issue.

Database specific

{
    "cwe_ids": [
        "CWE-276"
    ],
    "cna_assigner": "apache",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/46xxx/CVE-2024-46544.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.2.9-beta"
                },
                {
                    "last_affected": "1.2.49"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "1.2.9-beta"
                },
                {
                    "fixed": "1.2.49"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

References

Affected packages

Git / github.com/apache/tomcat-connectors

Affected ranges

Type

GIT

Repo

https://github.com/apache/tomcat-connectors

Events

Introduced

f48d0853cc16db3a62e27f0a1bf3522b8044906f

Fixed

9612683ac09ebb06aca9ad25cdd7274152c6d031

Database specific

{
    "extracted_events": [
        {
            "introduced": "1.2.9"
        },
        {
            "fixed": "1.2.50"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:apache:tomcat_connectors:*:*:*:*:*:*:*:*"
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-46544.json"