{"id":2733612,"date":"2025-03-19T12:35:54","date_gmt":"2025-03-19T19:35:54","guid":{"rendered":"https:\/\/www.esri.com\/arcgis-blog\/?post_type=blog&p=2733612"},"modified":"2025-05-27T15:08:37","modified_gmt":"2025-05-27T22:08:37","slug":"recent-apache-tomcat-rce-vulnerabilities","status":"publish","type":"blog","link":"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/recent-apache-tomcat-rce-vulnerabilities","title":{"rendered":"Recent Apache Tomcat RCE Vulnerabilities"},"author":5311,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","format":"standard","meta":{"_acf_changed":false,"_searchwp_excluded":""},"categories":[37501],"tags":[24081,24071,241722,778842],"industry":[],"product":[763582],"class_list":["post-2733612","blog","type-blog","status-publish","format-standard","hentry","category-administration","tag-ssamymlgp","tag-security","tag-ssamlymlgp","tag-tomcat","product-trust-arcgis"],"acf":{"short_description":"Recent media-hyped Apache Tomcat vulnerabilities NOT exploitable in ArcGIS Enterprise","flexible_content":[{"acf_fc_layout":"content","content":"

There has been a recent string of media-hyped open-source component vulnerabilities in Apache Tomcat<\/a> over the last several weeks. One of these (CVE-2025-24813<\/a>) is receiving heightened scrutiny because it is reported as having been exploited in the wild just a few days after a proof-of-concept was released.<\/p>\n

In addition to CVE-2025-24813<\/a>, other recently created, similar Tomcat vulnerabilities include CVE-2024-50379<\/a> and CVE-2024-56337<\/a><\/p>\n

While Apache Tomcat is shipped in each server component of ArcGIS Enterprise, we have validated that ArcGIS Enterprise is not vulnerable to any of these three issues because ArcGIS Enterprise software does not meet the requirements for exploit.<\/p>\n

Specifically, ArcGIS Enterprise does not enable the non-default write operation on the default Tomcat servlet, which is the first requirement for exploiting any of these CVEs.<\/strong> Without explicitly enabling this option, these three CVEs are not exploitable<\/strong> in Apache Tomcat.<\/p>\n

A security scanner run against ArcGIS Enterprise may incorrectly flag these issues as a concern.\u00a0 This is because some security scanners may detect a vulnerable version of Apache Tomcat, however we have confirmed that Tomcat is not used a way that would make it vulnerable to these CVEs.<\/p>\n

With that said, users who deploy the ArcGIS Web Adaptor for Java using Tomcat should take the time to validate in their Tomcat installs if the \u00a0non-default write operation on the default servlet is enabled, check to see if the PUT method is enabled, and plan to upgrade to an unaffected version of Tomcat.<\/p>\n