<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div id="preamble" style="box-sizing: border-box; orphans: 2; text-align: left; text-indent: 0px; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;" data-mce-style="box-sizing: border-box; color: #000000; font-family: Roboto, 'Open Sans', -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, 'Noto Sans', sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol', 'Noto Color Emoji'; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><div class="sectionbody" style="box-sizing: border-box;" data-mce-style="box-sizing: border-box;"><div class="paragraph" style="box-sizing: border-box;" data-mce-style="box-sizing: border-box;"><p style="box-sizing: border-box; margin: 0px; max-width: 80rem;" data-mce-style="box-sizing: border-box; margin: 0px; max-width: 80rem;"><span style="font-family: Roboto, "Open Sans", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"; font-size: 12pt;">Date: 18. 03. 2025</span><br><span style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;" data-mce-style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;"></span></p><p style="box-sizing: border-box; margin: 0px; max-width: 80rem;" data-mce-style="box-sizing: border-box; margin: 0px; max-width: 80rem;"><span style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;" data-mce-style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;">Severity: 6.3 (High)</span></p><p style="box-sizing: border-box; margin: 0px; max-width: 80rem;" data-mce-style="box-sizing: border-box; margin: 0px; max-width: 80rem;"><span style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;" data-mce-style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;">Affected versions: All midPoint versions prior to 4.8.7, 4.9.2</span></p><p style="box-sizing: border-box; margin: 0px; max-width: 80rem;" data-mce-style="box-sizing: border-box; margin: 0px; max-width: 80rem;"><span style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;" data-mce-style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;">Fixed in versions: 4.8.7, 4.9.2</span></p><p style="box-sizing: border-box; margin: 0px; max-width: 80rem;" data-mce-style="box-sizing: border-box; margin: 0px; max-width: 80rem;"><span style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;" data-mce-style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;"><br></span></p><p style="box-sizing: border-box; margin: 0px; max-width: 80rem;" data-mce-style="box-sizing: border-box; margin: 0px; max-width: 80rem;"><span style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;" data-mce-style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;">Description</span></p><p style="box-sizing: border-box; margin: 0px; max-width: 80rem;" data-mce-style="box-sizing: border-box; margin: 0px; max-width: 80rem;"><span style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;" data-mce-style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;">An attacker may exploit vulnerablity CVE-2025-24813 if writes for the default servlet are enabled (this is disabled by default in midPoint).</span></p><p style="box-sizing: border-box; margin: 0px; max-width: 80rem;" data-mce-style="box-sizing: border-box; margin: 0px; max-width: 80rem;"><span style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;" data-mce-style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;">Attacker may inject content to files uploaded using Tomcat (midPoint uses Wicket upload instead of Tomcat) and may try deserialization attack using file based session persistance.</span></p><p style="box-sizing: border-box; margin: 0px; max-width: 80rem;" data-mce-style="box-sizing: border-box; margin: 0px; max-width: 80rem;"><span style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;" data-mce-style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;"><br></span></p><p style="box-sizing: border-box; margin: 0px; max-width: 80rem;" data-mce-style="box-sizing: border-box; margin: 0px; max-width: 80rem;"><span style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;" data-mce-style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;">Severity and Impact</span></p><p style="box-sizing: border-box; margin: 0px; max-width: 80rem;" data-mce-style="box-sizing: border-box; margin: 0px; max-width: 80rem;"><span style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;" data-mce-style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;">This is High Severity Issue.</span></p><p style="box-sizing: border-box; margin: 0px; max-width: 80rem;" data-mce-style="box-sizing: border-box; margin: 0px; max-width: 80rem;"><span style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;" data-mce-style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;">The attacker may be able to create / modify Tomcat uploads on midPoint servers when custom Tomcat configuration is used.</span></p><p style="box-sizing: border-box; margin: 0px; max-width: 80rem;" data-mce-style="box-sizing: border-box; margin: 0px; max-width: 80rem;"><span style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;" data-mce-style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;"><br></span></p><p style="box-sizing: border-box; margin: 0px; max-width: 80rem;" data-mce-style="box-sizing: border-box; margin: 0px; max-width: 80rem;"><span style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;" data-mce-style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;">Mitigation</span></p><p style="box-sizing: border-box; margin: 0px; max-width: 80rem;" data-mce-style="box-sizing: border-box; margin: 0px; max-width: 80rem;"><span style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;" data-mce-style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;">Users of affected MidPoint versions are advised to upgrade their deployments to the latest maintenance releases.</span></p><p style="box-sizing: border-box; margin: 0px; max-width: 80rem;" data-mce-style="box-sizing: border-box; margin: 0px; max-width: 80rem;"><span style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;" data-mce-style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;">If it is not possible, verify that your Tomcat configuration override does not enable writes for default server. This is usually achieved by modifying application.yml.</span></p><p style="box-sizing: border-box; margin: 0px; max-width: 80rem;" data-mce-style="box-sizing: border-box; margin: 0px; max-width: 80rem;"><span style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;" data-mce-style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;"></span><br></p><p style="box-sizing: border-box; margin: 0px; max-width: 80rem;" data-mce-style="box-sizing: border-box; margin: 0px; max-width: 80rem;"><span style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;" data-mce-style="font-family: Roboto, Open Sans, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica Neue, Arial, Noto Sans, sans-serif, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji;"><span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;">This advisory is also available at </span></span><a href="https://docs.evolveum.com/midpoint/security/advisories/026-potential-tomcat-rce-vulnerability/" data-mce-href="https://docs.evolveum.com/midpoint/security/advisories/026-potential-tomcat-rce-vulnerability/">https://docs.evolveum.com/midpoint/security/advisories/026-potential-tomcat-rce-vulnerability/</a></p><p style="box-sizing: border-box; margin: 0px; max-width: 80rem;" data-mce-style="box-sizing: border-box; margin: 0px; max-width: 80rem;"><br></p><pre style="white-space: pre-wrap; overflow-wrap: break-word !important; color: #000000; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;" data-mce-style="white-space: pre-wrap; overflow-wrap: break-word !important; color: #000000; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">--
Anton Tkáčik
Software Developer
evolveum.com </pre><div style="clear: both;" data-mce-style="clear: both;"><br></div></div></div></div><div id="pageEval" style="box-sizing: border-box; text-align: center; font-size: 1.4rem; margin-top: 20px; font-weight: 600; color: #000000; font-family: Roboto, 'Open Sans', -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, 'Noto Sans', sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol', 'Noto Color Emoji'; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;" data-mce-style="box-sizing: border-box; text-align: center; font-size: 1.4rem; margin-top: 20px; font-weight: 600; color: #000000; font-family: Roboto, 'Open Sans', -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, 'Noto Sans', sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol', 'Noto Color Emoji'; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"></div></div></body></html>