Why SolarWinds DPA, SEM, and WHD are not affected by CVE-2025-24813

In 2025, the National Institute of Standards and Technology (NIST) published a security bulletin about CVE-2025-24813.

CVE-2025-24813 is a remote code execution vulnerability and/or information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.

If all the following were true, a malicious user could view security sensitive files and/or inject content into those files:

• writes enabled for the default servlet (disabled by default)
• support for partial PUT (enabled by default)
• a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads
• attacker knowledge of the names of security sensitive files being uploaded
• the security sensitive files also being uploaded via partial PUT

If all the following were true, a malicious user was able to perform remote code execution:

• writes enabled for the default servlet (disabled by default)
• support for partial PUT (enabled by default)
• application was using Tomcat's file-based session persistence with the default storage location
• application included a library that may be leveraged in a deserialization attack

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.

The vulnerability described in this CVE affects numerous software companies, but it does not impact SolarWinds Database Performance Analyzer (DPA), Security Event Manager (SEM), and Web Help Desk (WHD).

CVE-2025-24813

This vulnerability affects only applications that meet all the pre-requisites mentioned above.