Read the docs
TI-2016-05837 Aliases CVE-2016-6796GHSA-3mjp-p938-4329

A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to…

Priority MEDIUM 50Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 15 fixed, 10 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.08321 94th percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat (Maven): 9.0.0.M10, 8.5.5, 8.0.37 +2Red Hat: 9 advisoriesRed Hat: 15 fixed, 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Tomcat9.0.0.M1 to 9.0.0.M9; 8.5.0 to 8.5.4; 8.0.0.RC1 to 8.0.36; 7.0.0 to 7.0.70; 6.0.0 to 6.0.45—No fix listedCNA
—org.apache.tomcat:tomcat (Maven)9.0.0.M1 to before 9.0.0.M109.0.0.M10Patch availableGHSA-3mjp-p938-4329
—org.apache.tomcat:tomcat (Maven)8.5.0 to before 8.5.58.5.5Patch availableGHSA-3mjp-p938-4329
—org.apache.tomcat:tomcat (Maven)8.0.0.RC1 to before 8.0.378.0.37Patch availableGHSA-3mjp-p938-4329
—org.apache.tomcat:tomcat (Maven)7.0.0 to before 7.0.717.0.71Patch availableGHSA-3mjp-p938-4329
—org.apache.tomcat:tomcat (Maven)6.0.0 to before 6.0.466.0.46Patch availableGHSA-3mjp-p938-4329
  • Apache Tomcat VendorApache Affected 9.0.0.M1 to 9.0.0.M9; 8.5.0 to 8.5.4; 8.0.0.RC1 to 8.0.36; 7.0.0 to 7.0.70; 6.0.0 to 6.0.45 Fixed in — No fix listed CNA
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 9.0.0.M1 to before 9.0.0.M10 Fixed in 9.0.0.M10 Patch available GHSA-3mjp-p938-4329
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 8.5.0 to before 8.5.5 Fixed in 8.5.5 Patch available GHSA-3mjp-p938-4329
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 8.0.0.RC1 to before 8.0.37 Fixed in 8.0.37 Patch available GHSA-3mjp-p938-4329
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 7.0.0 to before 7.0.71 Fixed in 7.0.71 Patch available GHSA-3mjp-p938-4329
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 6.0.0 to before 6.0.46 Fixed in 6.0.46 Patch available GHSA-3mjp-p938-4329

CPE configurations NVD · 31

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*6.0.0 – 6.0.45; 7.0.0 – 7.0.70; 8.0 – 8.0.36; 8.5.0 – 8.5.4VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*9.0.0 milestone1VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*9.0.0 milestone2VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*9.0.0 milestone3VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*9.0.0 milestone4VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*9.0.0 milestone5VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*9.0.0 milestone6VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*9.0.0 milestone7VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*9.0.0 milestone8VulnerableApache
cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*9.0.0 milestone9VulnerableApache
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 6.0.0 – 6.0.45; 7.0.0 – 7.0.70; 8.0 – 8.0.36; 8.5.0 – 8.5.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:* Versions 9.0.0 milestone1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:* Versions 9.0.0 milestone2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:* Versions 9.0.0 milestone3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:* Versions 9.0.0 milestone4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:* Versions 9.0.0 milestone5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:* Versions 9.0.0 milestone6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:* Versions 9.0.0 milestone7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:* Versions 9.0.0 milestone8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* Versions 9.0.0 milestone9 Vulnerable ·Apache
Show 21 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*16.04VulnerableCanonical
cpe:2.3:a:oracle:tekelec_platform_distribution:7.4.0:*:*:*:*:*:*:*7.4.0VulnerableOracle
cpe:2.3:a:oracle:tekelec_platform_distribution:7.7.1:*:*:*:*:*:*:*7.7.1VulnerableOracle
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4:*:*:*:*:*:*:*6.4VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*7.5VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*7.7VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*7.7VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*7.7VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:a:oracle:tekelec_platform_distribution:7.4.0:*:*:*:*:*:*:* Versions 7.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:tekelec_platform_distribution:7.7.1:*:*:*:*:*:*:* Versions 7.7.1 Vulnerable ·Oracle
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4:*:*:*:*:*:*:* Versions 6.4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-3mjp-p938-4329 org.apache.tomcat:tomcat (Maven) Fixed in 9.0.0.M10 Advisory →
  • Fix · GHSA-3mjp-p938-4329 org.apache.tomcat:tomcat (Maven) Fixed in 8.5.5 Advisory →
  • Fix · GHSA-3mjp-p938-4329 org.apache.tomcat:tomcat (Maven) Fixed in 8.0.37 Advisory →
  • Fix · GHSA-3mjp-p938-4329 org.apache.tomcat:tomcat (Maven) Fixed in 7.0.71 Advisory →
  • Fix · GHSA-3mjp-p938-4329 org.apache.tomcat:tomcat (Maven) Fixed in 6.0.46 Advisory →

Red Hat 9 advisories

  • RHSA-2017:2247 Released 2017-08-01 · Red Hat rating Low
    tomcat security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Client (v. 7) tomcat-7.0.76-2.el7, tomcat-servlet-3.0-api-7.0.76-2.el7
    • Red Hat Enterprise Linux Client Optional (v. 7) tomcat-7.0.76-2.el7, tomcat-admin-webapps-7.0.76-2.el7, tomcat-docs-webapp-7.0.76-2.el7 +6
    • Red Hat Enterprise Linux ComputeNode (v. 7) tomcat-7.0.76-2.el7, tomcat-servlet-3.0-api-7.0.76-2.el7
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat-7.0.76-2.el7, tomcat-admin-webapps-7.0.76-2.el7, tomcat-docs-webapp-7.0.76-2.el7 +6
    • Red Hat Enterprise Linux Server (v. 7) tomcat-7.0.76-2.el7, tomcat-admin-webapps-7.0.76-2.el7, tomcat-el-2.2-api-7.0.76-2.el7 +4
    • Red Hat Enterprise Linux Server Optional (v. 7) tomcat-7.0.76-2.el7, tomcat-admin-webapps-7.0.76-2.el7, tomcat-docs-webapp-7.0.76-2.el7 +6
    • Red Hat Enterprise Linux Workstation (v. 7) tomcat-7.0.76-2.el7, tomcat-admin-webapps-7.0.76-2.el7, tomcat-el-2.2-api-7.0.76-2.el7 +4
    • Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-docs-webapp-7.0.76-2.el7, tomcat-javadoc-7.0.76-2.el7, tomcat-jsvc-7.0.76-2.el7
  • RHSA-2017:1552 Released 2017-06-20 · Red Hat rating Moderate
    jboss-ec2-eap security, bug fix, and enhancement update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server jboss-ec2-eap-7.5.16-1.Final_redhat_1.ep6.el6, jboss-ec2-eap-samples-7.5.16-1.Final_redhat_1.ep6.el6
  • RHSA-2017:1548 Released 2017-06-20 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 6.4.16 update on RHEL 7
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server hornetq-2.3.25-21.SP19_redhat_1.1.ep6.el7, ironjacamar-common-api-eap6-1.0.39-1.Final_redhat_1.1.ep6.el7, ironjacamar-common-impl-eap6-1.0.39-1.Final_redhat_1.1.ep6.el7 +47
Show 6 more Red Hat advisories
  • RHSA-2017:1549 Released 2017-06-20 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 6.4.16 update on RHEL 6
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server hornetq-2.3.25-21.SP19_redhat_1.1.ep6.el6, ironjacamar-common-api-eap6-1.0.39-1.Final_redhat_1.1.ep6.el6, ironjacamar-common-impl-eap6-1.0.39-1.Final_redhat_1.1.ep6.el6 +47
  • RHSA-2017:1550 Released 2017-06-20 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 6.4.16 update on RHEL 5
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server hornetq-2.3.25-21.SP19_redhat_1.1.ep6.el5, ironjacamar-common-api-eap6-1.0.39-1.Final_redhat_1.1.ep6.el5, ironjacamar-common-impl-eap6-1.0.39-1.Final_redhat_1.1.ep6.el5 +47
  • RHSA-2017:1551 Released 2017-06-20 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss Enterprise Application Platform 6.4
  • RHSA-2017:0455 Released 2017-03-07 · Red Hat rating Important
    Red Hat JBoss Web Server 3.1.0 security and enhancement update
    • Red Hat JBoss Web Server 3.1 for RHEL 6 hibernate4-c3p0-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6, hibernate4-core-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6, hibernate4-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6 +34
  • RHSA-2017:0456 Released 2017-03-07 · Red Hat rating Important
    Red Hat JBoss Web Server 3.1.0 security and enhancement update
    • Red Hat JBoss Web Server 3.1 for RHEL 7 hibernate4-c3p0-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7, hibernate4-core-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7, hibernate4-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7 +34
  • RHSA-2017:0457 Released 2017-03-07 · Red Hat rating Important
    Red Hat JBoss Web Server security and enhancement update
    • Red Hat JBoss Web Server 3.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache Tomcat — DSA-3720

    5 records Highest priority Priority MEDIUM 4 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2016-04337 Authentication bypass in Apache TomcatPriority MEDIUM 60
    • TI-2016-05838 Incorrect authorization in Apache TomcatPriority MEDIUM 50
    • TI-2016-00681 Observable discrepancy in Apache TomcatPriority MEDIUM 43
    Show all 5 records → Advisory →
  • Advisory ·

    Apache Tomcat — RHSA-2017:2247

    5 records Highest priority Priority MEDIUM 4 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2016-04337 Authentication bypass in Apache TomcatPriority MEDIUM 60
    • TI-2016-05838 Incorrect authorization in Apache TomcatPriority MEDIUM 50
    • TI-2016-00681 Observable discrepancy in Apache TomcatPriority MEDIUM 43
    Show all 5 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat JBoss BRMS 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Web Server 2AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Web Server 3AffectedNo fix yet: Fix deferred
Red Hat JBoss Fuse Service Works 6AffectedNo fix yet
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2017:2247
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2017:2247
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2017:2247
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2017:2247
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2017:2247
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2017:2247
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2017:2247
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2017:2247
Red Hat JBoss Enterprise Application Platform 6.4Fixed RHSA-2017:1551
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 ServerFixed RHSA-2017:1550
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 ServerFixed RHSA-2017:1549, RHSA-2017:1552
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 ServerFixed RHSA-2017:1548
Red Hat JBoss Web Server 3.1Fixed RHSA-2017:0457
Red Hat JBoss Web Server 3.1 for RHEL 6Fixed RHSA-2017:0455
Red Hat JBoss Web Server 3.1 for RHEL 7Fixed RHSA-2017:0456
Not affected: 1 product
  • Red Hat JBoss Fuse 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-6796
  2. 2026-10-03 Alias added: GHSA-3mjp-p938-4329
  3. 2026-10-08 CISA SSVC decision points changed

References

Patch 1

Advisory 13

Other 40

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
See all 273 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences