Authentication bypass in Apache Tomcat
Priority MEDIUM 60CWE-288Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 15 fixed, 11 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-288.
Summary
In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.10303 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.apache.tomcat:tomcat-jasper (Maven): 9.0.0.M10, 8.5.5, 8.0.37 +1org.apache.tomcat:jasper (Maven): 6.0.47+1 more productRed Hat: 9 advisoriesRed Hat: 15 fixed, 11 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Tomcat | 9.0.0.M1 to 9.0.0.M9; 8.5.0 to 8.5.4; 8.0.0.RC1 to 8.0.36; 7.0.0 to 7.0.70; 6.0.0 to 6.0.45 | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat-jasper (Maven) | 9.0.0.M1 to before 9.0.0.M10 | 9.0.0.M10 | Patch available | GHSA-4v3g-g84w-hv7r |
| — | org.apache.tomcat:tomcat-jasper (Maven) | 8.5.0 to before 8.5.5 | 8.5.5 | Patch available | GHSA-4v3g-g84w-hv7r |
| — | org.apache.tomcat:tomcat-jasper (Maven) | 8.0.0RC1 to before 8.0.37 | 8.0.37 | Patch available | GHSA-4v3g-g84w-hv7r |
| — | org.apache.tomcat:tomcat-jasper (Maven) | 7.0.0 to before 7.0.72 | 7.0.72 | Patch available | GHSA-4v3g-g84w-hv7r |
| — | org.apache.tomcat:jasper (Maven) | 6.0.0 to before 6.0.47 | 6.0.47 | Patch available | GHSA-4v3g-g84w-hv7r |
| — | org.apache.tomcat.embed:tomcat-embed-jasper (Maven) | 9.0.0.M1 to before 9.0.0.M10 | 9.0.0.M10 | Patch available | GHSA-4v3g-g84w-hv7r |
| — | org.apache.tomcat.embed:tomcat-embed-jasper (Maven) | 8.5.0 to before 8.5.5 | 8.5.5 | Patch available | GHSA-4v3g-g84w-hv7r |
| — | org.apache.tomcat.embed:tomcat-embed-jasper (Maven) | 8.0.0RC1 to before 8.0.37 | 8.0.37 | Patch available | GHSA-4v3g-g84w-hv7r |
| — | org.apache.tomcat.embed:tomcat-embed-jasper (Maven) | 7.0.0 to before 7.0.72 | 7.0.72 | Patch available | GHSA-4v3g-g84w-hv7r |
| — | org.apache.tomcat.embed:tomcat-embed-jasper (Maven) | 6.0.0 to before 6.0.47 | 6.0.47 | Patch available | GHSA-4v3g-g84w-hv7r |
- Apache Tomcat VendorApache Affected 9.0.0.M1 to 9.0.0.M9; 8.5.0 to 8.5.4; 8.0.0.RC1 to 8.0.36; 7.0.0 to 7.0.70; 6.0.0 to 6.0.45 Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat-jasper (Maven) Vendor— Affected 9.0.0.M1 to before 9.0.0.M10 Fixed in 9.0.0.M10 Patch available GHSA-4v3g-g84w-hv7r
- org.apache.tomcat:tomcat-jasper (Maven) Vendor— Affected 8.5.0 to before 8.5.5 Fixed in 8.5.5 Patch available GHSA-4v3g-g84w-hv7r
- org.apache.tomcat:tomcat-jasper (Maven) Vendor— Affected 8.0.0RC1 to before 8.0.37 Fixed in 8.0.37 Patch available GHSA-4v3g-g84w-hv7r
- org.apache.tomcat:tomcat-jasper (Maven) Vendor— Affected 7.0.0 to before 7.0.72 Fixed in 7.0.72 Patch available GHSA-4v3g-g84w-hv7r
- org.apache.tomcat:jasper (Maven) Vendor— Affected 6.0.0 to before 6.0.47 Fixed in 6.0.47 Patch available GHSA-4v3g-g84w-hv7r
- org.apache.tomcat.embed:tomcat-embed-jasper (Maven) Vendor— Affected 9.0.0.M1 to before 9.0.0.M10 Fixed in 9.0.0.M10 Patch available GHSA-4v3g-g84w-hv7r
- org.apache.tomcat.embed:tomcat-embed-jasper (Maven) Vendor— Affected 8.5.0 to before 8.5.5 Fixed in 8.5.5 Patch available GHSA-4v3g-g84w-hv7r
- org.apache.tomcat.embed:tomcat-embed-jasper (Maven) Vendor— Affected 8.0.0RC1 to before 8.0.37 Fixed in 8.0.37 Patch available GHSA-4v3g-g84w-hv7r
- org.apache.tomcat.embed:tomcat-embed-jasper (Maven) Vendor— Affected 7.0.0 to before 7.0.72 Fixed in 7.0.72 Patch available GHSA-4v3g-g84w-hv7r
- org.apache.tomcat.embed:tomcat-embed-jasper (Maven) Vendor— Affected 6.0.0 to before 6.0.47 Fixed in 6.0.47 Patch available GHSA-4v3g-g84w-hv7r
CPE configurations NVD · 30
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | 6.0.0 – 6.0.45; 7.0.0 – 7.0.70; 8.0 – 8.0.36; 8.5.0 – 8.5.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:* | 9.0.0 milestone1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:* | 9.0.0 milestone2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:* | 9.0.0 milestone3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:* | 9.0.0 milestone4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:* | 9.0.0 milestone5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:* | 9.0.0 milestone6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:* | 9.0.0 milestone7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:* | 9.0.0 milestone8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* | 9.0.0 milestone9 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 6.0.0 – 6.0.45; 7.0.0 – 7.0.70; 8.0 – 8.0.36; 8.5.0 – 8.5.4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:* Versions 9.0.0 milestone1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:* Versions 9.0.0 milestone2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:* Versions 9.0.0 milestone3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:* Versions 9.0.0 milestone4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:* Versions 9.0.0 milestone5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:* Versions 9.0.0 milestone6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:* Versions 9.0.0 milestone7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:* Versions 9.0.0 milestone8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* Versions 9.0.0 milestone9 Vulnerable ·Apache
Show 20 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4:*:*:*:*:*:*:* | 6.4 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:* | 3.0.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:* | 7.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:* | 7.5 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:* | 7.6 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:* | 7.7 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* | 7.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* | 7.6 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:* | 7.7 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* | 7.6 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* | 7.7 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:oracle:tekelec_platform_distribution:*:*:*:*:*:*:*:* | 7.4.0 – 7.7.1 | Vulnerable | Oracle |
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4:*:*:*:*:*:*:* Versions 6.4 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:oracle:tekelec_platform_distribution:*:*:*:*:*:*:*:* Versions 7.4.0 – 7.7.1 Vulnerable ·Oracle
Remediation
- Fix · GHSA-4v3g-g84w-hv7r org.apache.tomcat:tomcat-jasper (Maven) Fixed in 9.0.0.M10 Advisory →
- Fix · GHSA-4v3g-g84w-hv7r org.apache.tomcat:tomcat-jasper (Maven) Fixed in 8.5.5 Advisory →
- Fix · GHSA-4v3g-g84w-hv7r org.apache.tomcat:tomcat-jasper (Maven) Fixed in 8.0.37 Advisory →
- Fix · GHSA-4v3g-g84w-hv7r org.apache.tomcat:tomcat-jasper (Maven) Fixed in 7.0.72 Advisory →
- Fix · GHSA-4v3g-g84w-hv7r org.apache.tomcat:jasper (Maven) Fixed in 6.0.47 Advisory →
- Fix · GHSA-4v3g-g84w-hv7r org.apache.tomcat.embed:tomcat-embed-jasper (Maven) Fixed in 9.0.0.M10 Advisory →
- Fix · GHSA-4v3g-g84w-hv7r org.apache.tomcat.embed:tomcat-embed-jasper (Maven) Fixed in 8.5.5 Advisory →
- Fix · GHSA-4v3g-g84w-hv7r org.apache.tomcat.embed:tomcat-embed-jasper (Maven) Fixed in 8.0.37 Advisory →
- Fix · GHSA-4v3g-g84w-hv7r org.apache.tomcat.embed:tomcat-embed-jasper (Maven) Fixed in 7.0.72 Advisory →
- Fix · GHSA-4v3g-g84w-hv7r org.apache.tomcat.embed:tomcat-embed-jasper (Maven) Fixed in 6.0.47 Advisory →
Red Hat 9 advisories
- RHSA-2017:2247 Released 2017-08-01 · Red Hat rating Lowtomcat security, bug fix, and enhancement update
- Red Hat Enterprise Linux Client (v. 7) tomcat-7.0.76-2.el7, tomcat-servlet-3.0-api-7.0.76-2.el7
- Red Hat Enterprise Linux Client Optional (v. 7) tomcat-7.0.76-2.el7, tomcat-admin-webapps-7.0.76-2.el7, tomcat-docs-webapp-7.0.76-2.el7 +6
- Red Hat Enterprise Linux ComputeNode (v. 7) tomcat-7.0.76-2.el7, tomcat-servlet-3.0-api-7.0.76-2.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat-7.0.76-2.el7, tomcat-admin-webapps-7.0.76-2.el7, tomcat-docs-webapp-7.0.76-2.el7 +6
- Red Hat Enterprise Linux Server (v. 7) tomcat-7.0.76-2.el7, tomcat-admin-webapps-7.0.76-2.el7, tomcat-el-2.2-api-7.0.76-2.el7 +4
- Red Hat Enterprise Linux Server Optional (v. 7) tomcat-7.0.76-2.el7, tomcat-admin-webapps-7.0.76-2.el7, tomcat-docs-webapp-7.0.76-2.el7 +6
- Red Hat Enterprise Linux Workstation (v. 7) tomcat-7.0.76-2.el7, tomcat-admin-webapps-7.0.76-2.el7, tomcat-el-2.2-api-7.0.76-2.el7 +4
- Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-docs-webapp-7.0.76-2.el7, tomcat-javadoc-7.0.76-2.el7, tomcat-jsvc-7.0.76-2.el7
- RHSA-2017:1552 Released 2017-06-20 · Red Hat rating Moderatejboss-ec2-eap security, bug fix, and enhancement update
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server jboss-ec2-eap-7.5.16-1.Final_redhat_1.ep6.el6, jboss-ec2-eap-samples-7.5.16-1.Final_redhat_1.ep6.el6
- RHSA-2017:1548 Released 2017-06-20 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 6.4.16 update on RHEL 7
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server hornetq-2.3.25-21.SP19_redhat_1.1.ep6.el7, ironjacamar-common-api-eap6-1.0.39-1.Final_redhat_1.1.ep6.el7, ironjacamar-common-impl-eap6-1.0.39-1.Final_redhat_1.1.ep6.el7 +47
Show 6 more Red Hat advisories
- RHSA-2017:1549 Released 2017-06-20 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 6.4.16 update on RHEL 6
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server hornetq-2.3.25-21.SP19_redhat_1.1.ep6.el6, ironjacamar-common-api-eap6-1.0.39-1.Final_redhat_1.1.ep6.el6, ironjacamar-common-impl-eap6-1.0.39-1.Final_redhat_1.1.ep6.el6 +47
- RHSA-2017:1550 Released 2017-06-20 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 6.4.16 update on RHEL 5
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server hornetq-2.3.25-21.SP19_redhat_1.1.ep6.el5, ironjacamar-common-api-eap6-1.0.39-1.Final_redhat_1.1.ep6.el5, ironjacamar-common-impl-eap6-1.0.39-1.Final_redhat_1.1.ep6.el5 +47
- RHSA-2017:1551 Released 2017-06-20 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform security update
- Red Hat JBoss Enterprise Application Platform 6.4
- RHSA-2017:0455 Released 2017-03-07 · Red Hat rating ImportantRed Hat JBoss Web Server 3.1.0 security and enhancement update
- Red Hat JBoss Web Server 3.1 for RHEL 6 hibernate4-c3p0-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6, hibernate4-core-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6, hibernate4-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6 +34
- RHSA-2017:0456 Released 2017-03-07 · Red Hat rating ImportantRed Hat JBoss Web Server 3.1.0 security and enhancement update
- Red Hat JBoss Web Server 3.1 for RHEL 7 hibernate4-c3p0-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7, hibernate4-core-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7, hibernate4-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7 +34
- RHSA-2017:0457 Released 2017-03-07 · Red Hat rating ImportantRed Hat JBoss Web Server security and enhancement update
- Red Hat JBoss Web Server 3.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Apache Tomcat — DSA-3720
5 records Highest priority Priority MEDIUM 4 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2016-05838 Incorrect authorization in Apache TomcatPriority MEDIUM 50
- TI-2016-05837 A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to…Priority MEDIUM 50
- TI-2016-00681 Observable discrepancy in Apache TomcatPriority MEDIUM 43
- Advisory ·
Apache Tomcat — RHSA-2017:2247
5 records Highest priority Priority MEDIUM 4 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2016-05838 Incorrect authorization in Apache TomcatPriority MEDIUM 50
- TI-2016-05837 A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to…Priority MEDIUM 50
- TI-2016-00681 Observable discrepancy in Apache TomcatPriority MEDIUM 43
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 5 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Web Server 2 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Web Server 3 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix yet |
| Red Hat JBoss Operations Network 3 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2017:2247 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2017:2247 |
| Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2017:2247 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2017:2247 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2017:2247 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2017:2247 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2017:2247 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2017:2247 |
| Red Hat JBoss Enterprise Application Platform 6.4 | Fixed | RHSA-2017:1551 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server | Fixed | RHSA-2017:1550 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server | Fixed | RHSA-2017:1549, RHSA-2017:1552 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server | Fixed | RHSA-2017:1548 |
| Red Hat JBoss Web Server 3.1 | Fixed | RHSA-2017:0457 |
| Red Hat JBoss Web Server 3.1 for RHEL 6 | Fixed | RHSA-2017:0455 |
| Red Hat JBoss Web Server 3.1 for RHEL 7 | Fixed | RHSA-2017:0456 |
Timeline
- 2026-10-02 Threatist record created from CVE-2016-5018
- 2026-10-03 Alias added: GHSA-4v3g-g84w-hv7r
- 2026-10-08 CISA SSVC decision points changed
References
Advisory 13
Other 36
- [announce] 20161027 [SECURITY] CVE-2016-5018 Apache Tomcat Security Manager Bypass
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
- [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
- [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
- https://github.com/apache/tomcat/commit/648122fef84d3b43223e0b5ae668f84719dada0a
- https://github.com/apache/tomcat/commit/890a2f681ed2f3461b27983d7da9737375ff2ae4
- https://github.com/apache/tomcat/commit/a6b1ebc246b91b854237e5aad3dfd2b5460ea282
- https://lists.apache.org/thread.html/9b3a63a20c87179815fdea14f6766853bafe79a0042dc0b4aa878a9e@%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
- https://security.netapp.com/advisory/ntap-20180605-0001
- https://usn.ubuntu.com/4557-1
- https://web.archive.org/web/20161125134649/http://www.securityfocus.com/bid/93942
- https://web.archive.org/web/20170908024318/http://www.securitytracker.com/id/1037142
- https://web.archive.org/web/20171012232225/http://www.securitytracker.com/id/1038757
- https://github.com/apache/tomcat
- https://github.com/search?q=repo%3Aapache%2Ftomcat+jasper.runtime+path%3A%2F%5Eres%5C%2Fbnd%5C%2F%2F&type=code
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2016-5018 · CVE Program
- CVE-2016-5018 · NVD
- FIRST EPSS
- GHSA-4v3g-g84w-hv7r · GitHub Advisory Database · CC BY 4.0
- CVE-2016-5018 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences