Threats tagged 'ghsa-5j33-cvvr-w245'

A Time-of-check Time-of-use (TOCTOU) race condition vulnerability exists in Apache Tomcat during JSP compilation. This flaw permits remote code execution (RCE) on case-insensitive file systems when the default servlet is enabled for write access, which is a non-default configuration. The vulnerability affects multiple versions across Apache Tomcat 8.5, 9.0, 10.1, and 11.0 branches. Fixed versions are available and users are advised to upgrade to these to mitigate the risk.