CVE-2024-52316 - Improper Authorization

Abstract

Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.

The Oxygen products incorporate Apache Tomcat as a third-party libraries. This advisory was opened to address the potential impact of this third-party libraries vulnerability.

Affected Products/Versions

Mitigation

None

Detail

CVE-2024-52316

Severity: Critical

CVSS Score: 9.8

The Apache Tomcat third-party libraries used by Oxygen XML products are an affected version mentioned in CVE-2024-52316 vulnerability description. However, Oxygen products do not use ServerAuthContext. For that reason Oxygen products are not affected by this vulnerability.

Starting with Oxygen Content Fusion v7.1.1 build 2024120911 Apache Tomcat library was updatet to a version that fixes this vulnerability.

Starting with Oxygen XML Web Author v27.0.0 build 2024112223 Apache Tomcat library was updated to a version that fixes this vulnerability.