Skip to main content

Time-of-check Time-of-use (TOCTOU) Race Condition

CVE-2024-50379

High
9.2/10

Summary

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits Remote Code Execution on case-insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects org.apache.tomcat:tomcat-catalina package versions 9.0.0.M1 through 9.0.97, 10.1.0-M1 through 10.1.33 and 11.0.0-M1 through 11.0.1.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

The software checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the software to perform invalid actions when the resource is in an unexpected state.

References

Advisory Timeline

  • Published