CVE-2025-24813 - Apache Tomcat Path Equivalence Vulnerability
Project:Apache
Product:Tomcat
Date Added:2025-04-01Due Date:2025-04-22
Vulnerability Name
Apache Tomcat Path Equivalence Vulnerability
Description
Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request.
Known To Be Used in Ransomware Campaigns?
Unknown
Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Additional Notes
This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq
https://nvd.nist.gov/vuln/detail/CVE-2025-24813
Related News Articles
Brute-force attacks target Apache Tomcat management panelsJune 11, 2025
Critical Apache Roller Vulnerability (CVSS 10.0) Enables Unauthorized Session PersistenceApril 15, 2025
Critical Flaw in Apache Parquet Allows Remote Attackers to Execute Arbitrary CodeApril 4, 2025