CVE-2024-52318
Published: 18 November 2024
Summary
CVE-2024-52318 is a medium-severity Inadequate Encryption Strength (CWE-326) vulnerability in Apache Tomcat. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 5.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is an incorrect object recycling and reuse flaw, tracked as CVE-2024-52318 with CWE-326, that affects Apache Tomcat versions 11.0.0, 10.1.31, and 9.0.96. It carries a CVSS 3.1 base score of 6.1 reflecting network attack vector, low attack complexity, no required privileges, required user interaction, and changed scope with limited confidentiality and integrity impact.
An unauthenticated remote attacker can trigger the flaw via crafted requests that involve user interaction, resulting in improper reuse of objects that may allow limited disclosure or modification of sensitive data across security boundaries.
Apache Tomcat project advisories and the associated security announcements direct users to upgrade immediately to fixed releases 11.0.1, 10.1.32, or 9.0.97. The EPSS exploitation probability remains flat at 0.1547 with no material rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-3243
Vulnerability details
Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are recommended to upgrade to version 11.0.1, 10.1.32 or 9.0.97, which fixes the issue.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Maintaining currency with technologies and practices reduces selection of encryption mechanisms that provide inadequate strength.
Updated assessments identify when previously adequate encryption strength no longer meets current attack capabilities or compliance drivers.
Establishment procedures require selection and generation of keys with adequate length and strength for the chosen algorithm.
Specifies required cryptography types and parameters, preventing selection of inadequate encryption strength.
Prompt patching corrects inadequate encryption strength when vendors release updates that increase key sizes or algorithm security.