CVE-2024-52317

mediumPriorität · verfolgen · 11EPSS 0.021 · 82. PerzentilExploit · PoCCHDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

2.10% (82nd) EPSS

CVSS 6.5 · medium

Is it mine?

49 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-22

Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenAPROLabb_psirt
The problem is corrected in the following product versions: - APROL >= R 4.4-01P5 B&R recommends that customers apply the update at earliest convenience. The process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.
MitigationAPROLabb_psirt
Refer to section “General security recommendations” for further advise on how to keep your system secure.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.16.5mediumAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondary · ENISA EU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NsecondaryAusnutzbarkeit 3.9 · Auswirkung 2.5

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondary · OSV

v3.16.2mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:Psecondary · CVSS-BT (t0sche)

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:H/RL:O/RC:Csecondary · ABB PSIRT

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-326USCWE-326USCWE-326USCWE-326US

Exploits (1)

Öffentlicher Proof-of-Concept- und Exploit-Code.

TAM-K592/CVE-2024-52317CVE-2024-52317 - Apache Tomcat HTTP/2 Data Leakage VulnerabilityPoC · poc_in_github

betroffene Produkte (49)

Betroffene Produkte und Versionsbereiche.

B&R Industrial Automation GmbH APROLalle Versionenfixedabb_psirtCH
B&R Industrial Automation GmbH APROL< R 4.4-01P5abb_psirtCH
Amazon Linux 2alle Versionencert_bundDEcpe:/o:amazon:linux_2:-
Apache Tomcat <10.1.31alle Versionencert_bundDE
Apache Tomcat <11.0.0alle Versionencert_bundDE
Apache Tomcat <9.0.96alle Versionencert_bundDE
Debian Linuxalle Versionencert_bundDEcpe:/o:debian:debian_linux:-
Dell NetWorker <19.13.0.1alle Versionencert_bundDE
Dell OpenManage Server Administrator <11.1.0.0alle Versionencert_bundDE
Dell Secure Connect Gateway <5.34.00.16alle Versionencert_bundDE
IBM Integration Busalle Versionencert_bundDEcpe:/a:ibm:integration_bus:for_zos
IBM Integration Bus for zos 10.1-10.1.0.5alle Versionencert_bundDEcpe:/a:ibm:integration_bus:for_zos_10.1_-_10.1.0.5
IBM Power Hardware Management Console V10alle Versionencert_bundDEcpe:/a:ibm:hardware_management_console:v10
IBM Rational Build Forge <8.0.0.28alle Versionencert_bundDE
Oracle Linuxalle Versionencert_bundDEcpe:/o:oracle:linux:-
RESF Rocky Linuxalle Versionencert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Enterprise Linuxalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxalle Versionencert_bundDEcpe:/o:suse:suse_linux:-
SUSE openSUSEalle Versionencert_bundDEcpe:/o:suse:opensuse:-
Ubuntu Linuxalle Versionencert_bundDEcpe:/o:canonical:ubuntu_linux:-

20 von 49 angezeigt

Advisories (5)

Hersteller- und Ökosystem-Meldungen dazu.

SA26P011Security Issues addressed in APROL R 4.4-01P52026-07-06csaf · abb_psirtCH
An update is available that resolves several vulnerabilities and updates one or more 3rd party components in the product versions listed as affected in the advisory. An attacker who successfully exploited these vulnerabilities could impact the availability of the product, spoof identities or elevate privileges.
WID-SEC-W-2024-3486Apache Tomcat: Mehrere SchwachstellenDeutsch2024-11-17csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache Tomcat ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um falsche Informationen darzustellen.
WID-SEC-W-2024-3684IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2024-12-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen oder einen Spoofing-Angriff durchzuführen.
GHSA-qvf5-hvjx-wm27Apache Tomcat Request and/or response mix-up2024-11-18ghsa · osvUS
Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.
BIT-tomcat-2024-52317Apache Tomcat: Request/response mix-up with HTTP/22024-11-20vendor · osvUS
Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0 through 11.0.0, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv abb_psirt cert_bund NVD CVE.org MITRE

veröffentlicht 2024-11-18geändert 2026-06-17

Referenzen (6)

Externe Belege — Patches, Meldungen, Analysen.

https://lists.apache.org/thread/ty376mrxy1mmxtw3ogo53nc9l3co3dfs cnnvd
https://vigilance.fr/vulnerability/Apache-Tomcat-information-disclosure-via-Response-Recycling-45686 cnnvd
https://lists.apache.org/thread/ty376mrxy1mmxtw3ogo53nc9l3co3dfs enisa_euvd
http://www.openwall.com/lists/oss-security/2024/11/18/3Mailing ListThird Party Advisorynvd
https://lists.apache.org/thread/ty376mrxy1mmxtw3ogo53nc9l3co3dfsMailing ListVendor Advisorynvd
https://security.netapp.com/advisory/ntap-20250124-0004/Third Party Advisorynvd

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan