CVE-2024-52318

tomcat: incorrect JSP tag recycling leads to XSS

Loading…

Severity

Moderate

Red Hat Product Security

5.4

CVSS 3.1

Review impact separately from score.

Published · November 18, 2024

Updated · June 30, 2026

Description

A flaw was found in Apache Tomcat. Pooled JavaServer Pages (JSP) tags are not released after use, which could cause the output of some tags not to escape as expected. This unescaped output could leave the application vulnerable to Cross-site scripting (XSS).

Statement

Per the upstream advisory, this vulnerability is limited to Tomcat versions 9.0.96, 10.1.31, and 11.0.0. No Red Hat products are vulnerable to this flaw.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 5.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')