This has flagged as a vulnerability in the version of tomcat used bundled with Web Help Desk, at least as of 12.8.3. HF3.
Out of an abundance of caution, even though Apache is reporting this as low, I contacted support about upgrading just the bundled tomcat application out of cycle with the rest of the product to a non-affected version. Initially, I received some steps on how to do so, however using anything newer than the bundled version causes the application to crash at start. Validated this again with support and received a secondary response that it is a known issue and that upgrading the bundled version is not supported at this time due to something in newer releases breaking WHD.
I did get clarification that engineering is working on a solution to this CVE internally to WHD until they or Apache can sort out what is broken in the newer releases.
