erroneo.us
Search all guides⌘K

Digest · Monday

Security digest: March 10, 2025

1 editorial brief, 5 known exploited (cisa kev) additions and 2 critical advisories.

All digests · RSS · Markdown

Take stock

  • Most can relax: Apache Tomcat Partial PUT RCE (CVE-2025-24813). Tomcat deployments where the DefaultServlet has readonly set to false, especially combined with file-based session persistence (PersistentManager + FileStore).
  • Do you run any of these? Advantive VeraCore, Ivanti Endpoint Manager (EPM). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-03-31.
  • Maven: 1 critical advisory (org.apache.tomcat:tomcat-catalina, org.apache.tomcat.embed:tomcat-embed-core). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • PyPI: 1 critical advisory (plotai). Check with pip-audit (or: pip show <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Most can relax

· Vulnerability · CVE-2025-24813

Apache Tomcat Partial PUT RCE (CVE-2025-24813)

It is in KEV and attacks were seen within days, but exploitation needs the default servlet's write support turned on, which is off by default and rare; upgrade on your normal cycle and check that one setting.

Must act: Tomcat deployments where the DefaultServlet has readonly set to false, especially combined with file-based session persistence (PersistentManager + FileStore).

Can relax: The large majority of Tomcat users, who never enabled default-servlet writes, and anyone already on 9.0.99, 10.1.35, 11.0.3 or later.

  1. Check your version: run bin/version.sh (or catalina.sh version) and upgrade to 11.0.3, 10.1.35, 9.0.99 or later
  2. Check conf/web.xml and app web.xml files for the DefaultServlet readonly init-param set to false; remove it unless you truly need WebDAV-style uploads
  3. If writes must stay on, upgrade and avoid file-based session persistence in the default location

Read the brief →

Known exploited (CISA KEV) 5

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2025-25181Advantive VeraCore
Advantive VeraCore SQL Injection Vulnerability		2025-03-31
CVE-2024-57968Advantive VeraCore
Advantive VeraCore Unrestricted File Upload Vulnerability		2025-03-31
CVE-2024-13161Ivanti Endpoint Manager (EPM)
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability		2025-03-31
CVE-2024-13160Ivanti Endpoint Manager (EPM)
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability		2025-03-31
CVE-2024-13159Ivanti Endpoint Manager (EPM)
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability		2025-03-31

Critical advisories by ecosystem 2

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Maven 1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

PyPI 1

Check: pip-audit (or: pip show <package>)