Tomcat Vulnerability CVE-2025-24813 in co-relation with Jaspersoft and Clarity Integration

Products

• Clarity PPM On Premise
• Clarity PPM SaaS

Issue/Introduction

Is Jaspersoft impacted with Tomcat Vulnerability CVE-2025-24813?

Environment

Jaspersoft 9.x integrated with Clarity 

Resolution

CVE-2025-24813  Apache Tomcat is vulnerable to remote code execution (RCE), information disclosure, or corruption of information via a write-enabled Default Servlet.

The impact of exploitation depends on the following:

If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:

• Writes enabled for the default servlet (disabled by default)
• Support for partial PUT (enabled by default)
• A target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads
• Attacker knowledge of the names of security sensitive files being uploaded
• The security sensitive files also being uploaded via partial PUT

Hence the conclusion is CVE-2025-24813  is not impacted for Jaspersoft 9.x integrated with Clarity.