CVE-2024-52316

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-52316
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-52316.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-52316
Aliases
Downstream
Related
Published
2024-11-18T11:32:22.072Z
Modified
2026-07-11T03:55:34.909119051Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Apache Tomcat: Authentication bypass when using Jakarta Authentication API
Details

Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-391"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52316.json",
    "cna_assigner": "apache",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "11.0.0-M1"
                },
                {
                    "last_affected": "11.0.0-M26"
                },
                {
                    "introduced": "10.1.0-M1"
                },
                {
                    "last_affected": "10.1.30"
                },
                {
                    "introduced": "9.0.0-M1"
                },
                {
                    "last_affected": "9.0.95"
                },
                {
                    "introduced": "8.5.0"
                },
                {
                    "last_affected": "8.5.100"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "11.0.0-M1"
                },
                {
                    "fixed": "11.0.0-M26"
                },
                {
                    "introduced": "10.1.0-M1"
                },
                {
                    "fixed": "10.1.30"
                },
                {
                    "introduced": "9.0.0-M1"
                },
                {
                    "fixed": "9.0.95"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
16bf392c67833ad549733b58c350ff92b5ee782a
Fixed
7ecea31658766b7d0ce7fee5a34564b67c68e789
Introduced
e9d17cddc285615807ec5fef09240777436b25dc
Fixed
b07cda9f3cc385f6f2d6c0701a050317979745dc
Introduced
59c81e30e2f64f5e8c1db78c4860c51850dfb0bd
Database specific 
{
    "extracted_events": [
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.0.96"
        },
        {
            "introduced": "10.1.0"
        },
        {
            "fixed": "10.1.31"
        },
        {
            "introduced": "11.0.0-milestone1"
        },
        {
            "last_affected": "11.0.0-milestone1"
        },
        {
            "introduced": "11.0.0-milestone10"
        },
        {
            "last_affected": "11.0.0-milestone10"
        },
        {
            "introduced": "11.0.0-milestone11"
        },
        {
            "last_affected": "11.0.0-milestone11"
        },
        {
            "introduced": "11.0.0-milestone12"
        },
        {
            "last_affected": "11.0.0-milestone12"
        },
        {
            "introduced": "11.0.0-milestone13"
        },
        {
            "last_affected": "11.0.0-milestone13"
        },
        {
            "introduced": "11.0.0-milestone14"
        },
        {
            "last_affected": "11.0.0-milestone14"
        },
        {
            "introduced": "11.0.0-milestone15"
        },
        {
            "last_affected": "11.0.0-milestone15"
        },
        {
            "introduced": "11.0.0-milestone16"
        },
        {
            "last_affected": "11.0.0-milestone16"
        },
        {
            "introduced": "11.0.0-milestone17"
        },
        {
            "last_affected": "11.0.0-milestone17"
        },
        {
            "introduced": "11.0.0-milestone18"
        },
        {
            "last_affected": "11.0.0-milestone18"
        },
        {
            "introduced": "11.0.0-milestone19"
        },
        {
            "last_affected": "11.0.0-milestone19"
        },
        {
            "introduced": "11.0.0-milestone2"
        },
        {
            "last_affected": "11.0.0-milestone2"
        },
        {
            "introduced": "11.0.0-milestone20"
        },
        {
            "last_affected": "11.0.0-milestone20"
        },
        {
            "introduced": "11.0.0-milestone21"
        },
        {
            "last_affected": "11.0.0-milestone21"
        },
        {
            "introduced": "11.0.0-milestone22"
        },
        {
            "last_affected": "11.0.0-milestone22"
        },
        {
            "introduced": "11.0.0-milestone23"
        },
        {
            "last_affected": "11.0.0-milestone23"
        },
        {
            "introduced": "11.0.0-milestone24"
        },
        {
            "last_affected": "11.0.0-milestone24"
        },
        {
            "introduced": "11.0.0-milestone25"
        },
        {
            "last_affected": "11.0.0-milestone25"
        },
        {
            "introduced": "11.0.0-milestone26"
        },
        {
            "last_affected": "11.0.0-milestone26"
        },
        {
            "introduced": "11.0.0-milestone3"
        },
        {
            "last_affected": "11.0.0-milestone3"
        },
        {
            "introduced": "11.0.0-milestone4"
        },
        {
            "last_affected": "11.0.0-milestone4"
        },
        {
            "introduced": "11.0.0-milestone5"
        },
        {
            "last_affected": "11.0.0-milestone5"
        },
        {
            "introduced": "11.0.0-milestone6"
        },
        {
            "last_affected": "11.0.0-milestone6"
        },
        {
            "introduced": "11.0.0-milestone7"
        },
        {
            "last_affected": "11.0.0-milestone7"
        },
        {
            "introduced": "11.0.0-milestone8"
        },
        {
            "last_affected": "11.0.0-milestone8"
        },
        {
            "introduced": "11.0.0-milestone9"
        },
        {
            "last_affected": "11.0.0-milestone9"
        }
    ],
    "cpe": [
        "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone12:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone13:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone14:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone15:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone16:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone17:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone18:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone19:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone21:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone22:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone25:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone26:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

11.*
11.0.0-milestone1
11.0.0-milestone10
11.0.0-milestone11
11.0.0-milestone12
11.0.0-milestone13
11.0.0-milestone14
11.0.0-milestone15
11.0.0-milestone16
11.0.0-milestone17
11.0.0-milestone18
11.0.0-milestone19
11.0.0-milestone2
11.0.0-milestone20
11.0.0-milestone21
11.0.0-milestone22
11.0.0-milestone23
11.0.0-milestone24
11.0.0-milestone25
11.0.0-milestone26
11.0.0-milestone3
11.0.0-milestone4
11.0.0-milestone5
11.0.0-milestone6
11.0.0-milestone7
11.0.0-milestone8
11.0.0-milestone9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-52316.json"