Follow us
You can contact the Cybersecurity Council directly for your inquiries.
Join the CSC in protecting the UAE’s national security and strategic achievements.
Follow our channels on social media.
- published 2/26/25 9:48 AM •
- updated 20 January 2025 •
- 5 Min Read
Critical Vulnerability in F5 Traffix SDC
Alert Rating
Audience
Corporations, Government
On this page
Critical Vulnerability in F5 Traffix SDC
CVE-2024-52316 is a critical vulnerability affecting Apache Tomcat that allows authentication bypass under specific configurations. The vulnerability impacts Apache Tomcat versions 11.0.0-M1 through 11.0.0-M26, 10.1.0-M1 through 10.1.30, and 9.0.0-M1 through 9.0.95.
Vulnerability Details:
- CVE-2024-52316
- CVSS Base Score: 9.8 (Critical)
- If Tomcat is configured with a custom Jakarta Authentication ServerAuthContext component that throws an exception during authentication without setting an HTTP failure status, an attacker could bypass the authentication process.
- Exploitation of this vulnerability could lead to:
- Unauthorized access to sensitive data
- System compromise
- Privilege escalation
- Circumvention of resource isolation mechanisms
Affected Products:
- F5 products Traffix SDC version 5.2.0
Fixed Versions:
- Apache Tomcat 11.0.0 or later
- Apache Tomcat 10.1.31 or later
- Apache Tomcat 9.0.96 or later
Reference URL:
- https://my.f5.com/manage/s/article/K000149333?utm_source=f5support&utm_medium=RSS
Take Action
Protect yourself
The UAE Cyber Security Council recommends to review the attached document and apply the necessary updates as outlined by the vendor. These updates are crucial for addressing the identified security vulnerability and ensuring your system remains protected.
Stay Connected
Follow our channels
Take Action
Spread Awareness
Share this threat to raise awareness and help others stay alert
GET INVOLVED
Make a Difference
Other Threats
20 January 2025
Critical Vulnerability in F5 Traffix SDC
A critical vulnerability has been discovered in F5 Traffix SDC, linked to Apache Tomcat, which could allow attackers to gain unauthorized access to compromised systems.
Protecting
Corporations, Government
Share in:
17 January 2025
NVIDIA has released security updates to address multiple vulnerabilities in the NVIDIA Container Toolkit and NVIDIA GPU Operator.
Protecting
Corporations, Government
Share in:
16 January 2025
Critical Vulnerability in FortiSwitch Devices
A critical vulnerability (CVE-2023-37936) has been discovered in multiple versions of Fortinet FortiSwitch devices. This vulnerability, classified as a use of hard-coded cryptographic key [CWE-321], allows a remote unauthenticated attacker in possession of the key to execute unauthorized code via crafted cryptographic request.
Protecting
Corporations, Government
Share in:
