Improper access control in Apache Tomcat
Priority CRITICAL 100Exploited in the wildCWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 3 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-284.
Summary
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
Why it matters now
Exploitation Active In CISA KEV since 2023-05-12CISA due date 2023-06-02
EPSS 0.90338 99th percentileScored 2026-11-07
Fix Partial Apache Tomcat (Apache Software Foundation): 6.0.48, 7.0.73, 8.0.39 +2org.apache.tomcat:tomcat-catalina-jmx-remote (Maven): 6.0.48, 7.0.73, 8.0.39 +2+1 more productRed Hat: 3 advisoriesRed Hat: 3 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Tomcat | before 6.0.48; 7 to before 7.0.73; 8 to before 8.0.39; 8.5 to before 8.5.7; 9 to before 9.0.0.M12 | 6.0.48, 7.0.73, 8.0.39, 8.5.7, 9.0.0.M12 | Patch available | CNA |
| — | org.apache.tomcat:tomcat-catalina-jmx-remote (Maven) | before 6.0.48 | 6.0.48 | Patch available | GHSA-cw54-59pw-4g8c |
| — | org.apache.tomcat:tomcat-catalina-jmx-remote (Maven) | 7.0.0 to before 7.0.73 | 7.0.73 | Patch available | GHSA-cw54-59pw-4g8c |
| — | org.apache.tomcat:tomcat-catalina-jmx-remote (Maven) | 8.0.0 to before 8.0.39 | 8.0.39 | Patch available | GHSA-cw54-59pw-4g8c |
| — | org.apache.tomcat:tomcat-catalina-jmx-remote (Maven) | 8.5.0 to before 8.5.7 | 8.5.7 | Patch available | GHSA-cw54-59pw-4g8c |
| — | org.apache.tomcat:tomcat-catalina-jmx-remote (Maven) | 9.0.0.M1 to before 9.0.0.M12 | 9.0.0.M12 | Patch available | GHSA-cw54-59pw-4g8c |
| — | org.apache.tomcat:tomcat-catalina (Maven) | before 6.0.48 | 6.0.48 | Patch available | GHSA-cw54-59pw-4g8c |
| — | org.apache.tomcat:tomcat-catalina (Maven) | 7.0.0 to before 7.0.73 | 7.0.73 | Patch available | GHSA-cw54-59pw-4g8c |
| — | org.apache.tomcat:tomcat-catalina (Maven) | 8.0.0 to before 8.0.39 | 8.0.39 | Patch available | GHSA-cw54-59pw-4g8c |
| — | org.apache.tomcat:tomcat-catalina (Maven) | 8.5.0 to before 8.5.7 | 8.5.7 | Patch available | GHSA-cw54-59pw-4g8c |
| — | org.apache.tomcat:tomcat-catalina (Maven) | 9.0.0.M1 to before 9.0.0.M12 | 9.0.0.M12 | Patch available | GHSA-cw54-59pw-4g8c |
- Apache Tomcat VendorApache Affected before 6.0.48; 7 to before 7.0.73; 8 to before 8.0.39; 8.5 to before 8.5.7; 9 to before 9.0.0.M12 Fixed in 6.0.48, 7.0.73, 8.0.39, 8.5.7, 9.0.0.M12 Patch available CNA
- org.apache.tomcat:tomcat-catalina-jmx-remote (Maven) Vendor— Affected before 6.0.48 Fixed in 6.0.48 Patch available GHSA-cw54-59pw-4g8c
- org.apache.tomcat:tomcat-catalina-jmx-remote (Maven) Vendor— Affected 7.0.0 to before 7.0.73 Fixed in 7.0.73 Patch available GHSA-cw54-59pw-4g8c
- org.apache.tomcat:tomcat-catalina-jmx-remote (Maven) Vendor— Affected 8.0.0 to before 8.0.39 Fixed in 8.0.39 Patch available GHSA-cw54-59pw-4g8c
- org.apache.tomcat:tomcat-catalina-jmx-remote (Maven) Vendor— Affected 8.5.0 to before 8.5.7 Fixed in 8.5.7 Patch available GHSA-cw54-59pw-4g8c
- org.apache.tomcat:tomcat-catalina-jmx-remote (Maven) Vendor— Affected 9.0.0.M1 to before 9.0.0.M12 Fixed in 9.0.0.M12 Patch available GHSA-cw54-59pw-4g8c
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected before 6.0.48 Fixed in 6.0.48 Patch available GHSA-cw54-59pw-4g8c
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 7.0.0 to before 7.0.73 Fixed in 7.0.73 Patch available GHSA-cw54-59pw-4g8c
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 8.0.0 to before 8.0.39 Fixed in 8.0.39 Patch available GHSA-cw54-59pw-4g8c
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 8.5.0 to before 8.5.7 Fixed in 8.5.7 Patch available GHSA-cw54-59pw-4g8c
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 9.0.0.M1 to before 9.0.0.M12 Fixed in 9.0.0.M12 Patch available GHSA-cw54-59pw-4g8c
CPE configurations NVD · 51
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | before 6.0.48; 7.0.0 to before 7.0.73; 8.0 to before 8.0.39; 8.5.0 to before 8.5.7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:-:*:*:*:*:*:* | 9.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:* | 9.0.0 milestone1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:* | 9.0.0 milestone10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* | 9.0.0 milestone11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:* | 9.0.0 milestone2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:* | 9.0.0 milestone3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:* | 9.0.0 milestone4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:* | 9.0.0 milestone5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:* | 9.0.0 milestone6 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions before 6.0.48; 7.0.0 to before 7.0.73; 8.0 to before 8.0.39; 8.5.0 to before 8.5.7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:-:*:*:*:*:*:* Versions 9.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:* Versions 9.0.0 milestone1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:* Versions 9.0.0 milestone10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* Versions 9.0.0 milestone11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:* Versions 9.0.0 milestone2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:* Versions 9.0.0 milestone3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:* Versions 9.0.0 milestone4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:* Versions 9.0.0 milestone5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:* Versions 9.0.0 milestone6 Vulnerable ·Apache
Show 41 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:* | 9.0.0 milestone7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:* | 9.0.0 milestone8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* | 9.0.0 milestone9 | Vulnerable | Apache |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:* | 3.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:oracle:agile_engineering_data_management:6.1.3:*:*:*:*:*:*:* | 6.1.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:agile_engineering_data_management:6.2.0:*:*:*:*:*:*:* | 6.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:* | 6.2.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:* | 9.3.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* | 9.3.6 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_application_session_controller:3.7.1:*:*:*:*:*:*:* | 3.7.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_application_session_controller:3.8.0:*:*:*:*:*:*:* | 3.8.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1:*:*:*:*:*:*:* | 10.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_interactive_session_recorder:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_interactive_session_recorder:6.1:*:*:*:*:*:*:* | 6.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_interactive_session_recorder:6.2:*:*:*:*:*:*:* | 6.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:* | 4.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:* | 4.2.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:micros_relate_crm_software:10.8:*:*:*:*:*:*:* | 10.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:micros_relate_crm_software:11.4:*:*:*:*:*:*:* | 11.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.0.1:*:*:*:*:*:*:* | 10.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.5.0:*:*:*:*:*:*:* | 10.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.6.0:*:*:*:*:*:*:* | 10.6.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.7.7:*:*:*:*:*:*:* | 10.7.7 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.8.0:*:*:*:*:*:*:* | 10.8.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.8.1:*:*:*:*:*:*:* | 10.8.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* | up to 3.2.8.2223; 3.3.0 – 3.3.4.3247; 3.4.0 – 3.4.2.4181 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_convenience_and_fuel_pos_software:2.1.132:*:*:*:*:*:*:* | 2.1.132 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:transportation_management:6.3.0:*:*:*:*:*:*:* | 6.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:transportation_management:6.3.1:*:*:*:*:*:*:* | 6.3.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:transportation_management:6.3.2:*:*:*:*:*:*:* | 6.3.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:transportation_management:6.3.3:*:*:*:*:*:*:* | 6.3.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:transportation_management:6.3.4:*:*:*:*:*:*:* | 6.3.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:transportation_management:6.3.5:*:*:*:*:*:*:* | 6.3.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:transportation_management:6.3.6:*:*:*:*:*:*:* | 6.3.6 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:transportation_management:6.3.7:*:*:*:*:*:*:* | 6.3.7 | Vulnerable | Oracle |
- cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:* Versions 9.0.0 milestone7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:* Versions 9.0.0 milestone8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* Versions 9.0.0 milestone9 Vulnerable ·Apache
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:oracle:agile_engineering_data_management:6.1.3:*:*:*:*:*:*:* Versions 6.1.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:agile_engineering_data_management:6.2.0:*:*:*:*:*:*:* Versions 6.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:* Versions 6.2.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:* Versions 9.3.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* Versions 9.3.6 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_application_session_controller:3.7.1:*:*:*:*:*:*:* Versions 3.7.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_application_session_controller:3.8.0:*:*:*:*:*:*:* Versions 3.8.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1:*:*:*:*:*:*:* Versions 10.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_interactive_session_recorder:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_interactive_session_recorder:6.1:*:*:*:*:*:*:* Versions 6.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_interactive_session_recorder:6.2:*:*:*:*:*:*:* Versions 6.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:micros_relate_crm_software:10.8:*:*:*:*:*:*:* Versions 10.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:micros_relate_crm_software:11.4:*:*:*:*:*:*:* Versions 11.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.0.1:*:*:*:*:*:*:* Versions 10.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.5.0:*:*:*:*:*:*:* Versions 10.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.6.0:*:*:*:*:*:*:* Versions 10.6.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.7.7:*:*:*:*:*:*:* Versions 10.7.7 Vulnerable ·Oracle
- cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.8.0:*:*:*:*:*:*:* Versions 10.8.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.8.1:*:*:*:*:*:*:* Versions 10.8.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* Versions up to 3.2.8.2223; 3.3.0 – 3.3.4.3247; 3.4.0 – 3.4.2.4181 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_convenience_and_fuel_pos_software:2.1.132:*:*:*:*:*:*:* Versions 2.1.132 Vulnerable ·Oracle
- cpe:2.3:a:oracle:transportation_management:6.3.0:*:*:*:*:*:*:* Versions 6.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:transportation_management:6.3.1:*:*:*:*:*:*:* Versions 6.3.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:transportation_management:6.3.2:*:*:*:*:*:*:* Versions 6.3.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:transportation_management:6.3.3:*:*:*:*:*:*:* Versions 6.3.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:transportation_management:6.3.4:*:*:*:*:*:*:* Versions 6.3.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:transportation_management:6.3.5:*:*:*:*:*:*:* Versions 6.3.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:transportation_management:6.3.6:*:*:*:*:*:*:* Versions 6.3.6 Vulnerable ·Oracle
- cpe:2.3:a:oracle:transportation_management:6.3.7:*:*:*:*:*:*:* Versions 6.3.7 Vulnerable ·Oracle
Remediation
- Fix · CNA Apache Tomcat (Apache Software Foundation) Fixed in 6.0.48, 7.0.73, 8.0.39, 8.5.7, 9.0.0.M12
- Fix · GHSA-cw54-59pw-4g8c org.apache.tomcat:tomcat-catalina-jmx-remote (Maven) Fixed in 6.0.48 Advisory →
- Fix · GHSA-cw54-59pw-4g8c org.apache.tomcat:tomcat-catalina-jmx-remote (Maven) Fixed in 7.0.73 Advisory →
- Fix · GHSA-cw54-59pw-4g8c org.apache.tomcat:tomcat-catalina-jmx-remote (Maven) Fixed in 8.0.39 Advisory →
- Fix · GHSA-cw54-59pw-4g8c org.apache.tomcat:tomcat-catalina-jmx-remote (Maven) Fixed in 8.5.7 Advisory →
- Fix · GHSA-cw54-59pw-4g8c org.apache.tomcat:tomcat-catalina-jmx-remote (Maven) Fixed in 9.0.0.M12 Advisory →
- Fix · GHSA-cw54-59pw-4g8c org.apache.tomcat:tomcat-catalina (Maven) Fixed in 6.0.48 Advisory →
- Fix · GHSA-cw54-59pw-4g8c org.apache.tomcat:tomcat-catalina (Maven) Fixed in 7.0.73 Advisory →
- Fix · GHSA-cw54-59pw-4g8c org.apache.tomcat:tomcat-catalina (Maven) Fixed in 8.0.39 Advisory →
- Fix · GHSA-cw54-59pw-4g8c org.apache.tomcat:tomcat-catalina (Maven) Fixed in 8.5.7 Advisory →
- Fix · GHSA-cw54-59pw-4g8c org.apache.tomcat:tomcat-catalina (Maven) Fixed in 9.0.0.M12 Advisory →
Red Hat 3 advisories
- RHSA-2017:0455 Released 2017-03-07 · Red Hat rating ImportantRed Hat JBoss Web Server 3.1.0 security and enhancement update
- Red Hat JBoss Web Server 3.1 for RHEL 6 hibernate4-c3p0-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6, hibernate4-core-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6, hibernate4-eap6-4.2.23-1.Final_redhat_1.1.ep6.el6 +34
- RHSA-2017:0456 Released 2017-03-07 · Red Hat rating ImportantRed Hat JBoss Web Server 3.1.0 security and enhancement update
- Red Hat JBoss Web Server 3.1 for RHEL 7 hibernate4-c3p0-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7, hibernate4-core-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7, hibernate4-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7 +34
- RHSA-2017:0457 Released 2017-03-07 · Red Hat rating ImportantRed Hat JBoss Web Server security and enhancement update
- Red Hat JBoss Web Server 3.1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Enterprise Web Server 2 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Web Server 3 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Web Server 3.1 | Fixed | RHSA-2017:0457 |
| Red Hat JBoss Web Server 3.1 for RHEL 6 | Fixed | RHSA-2017:0455 |
| Red Hat JBoss Web Server 3.1 for RHEL 7 | Fixed | RHSA-2017:0456 |
Not affected: 11 products
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat JBoss Data Grid 6
- Red Hat JBoss Data Virtualization 6
- Red Hat JBoss Enterprise Application Platform 5
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Fuse 6
- Red Hat JBoss Operations Network 3
- Red Hat JBoss Portal 6
- Red Hat Software Collections
Timeline
- 2023-05-12 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2016-8735
- 2026-10-03 Alias added: GHSA-cw54-59pw-4g8c
References
Patch 23
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://svn.apache.org/viewvc?view=revision&revision=1767676
- http://svn.apache.org/viewvc?view=revision&revision=1767644
- http://svn.apache.org/viewvc?view=revision&revision=1767656
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://svn.apache.org/viewvc?view=revision&revision=1767684
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
- [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
Advisory 12
- http://tomcat.apache.org/security-9.html
- DSA-3738
- http://tomcat.apache.org/security-7.html
- http://tomcat.apache.org/security-8.html
- https://security.netapp.com/advisory/ntap-20180607-0001/
- http://tomcat.apache.org/security-6.html
- RHSA-2017:0457
- RHSA-2017:0455
- RHSA-2017:0456
- http://seclists.org/oss-sec/2016/q4/502
- USN-4557-1
- https://nvd.nist.gov/vuln/detail/CVE-2016-8735
Other 25
- https://github.com/apache/tomcat/commit/0e83ad3e547fc9a75a258799ef581249b40a82a6
- https://github.com/apache/tomcat/commit/292d6ccdc9edbf80859929b0af070b2ea99fa688
- https://github.com/apache/tomcat/commit/7e3a037055cca4a17e90b49399fb1bab4dd7c821
- https://github.com/apache/tomcat80/commit/0f76016a4ec45635e450ada9c84ff7ee0c5f3799
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
- https://security.netapp.com/advisory/ntap-20180607-0001
- https://usn.ubuntu.com/4557-1
- https://web.archive.org/web/20170423095340/http://www.securityfocus.com/bid/94463
- https://web.archive.org/web/20170928203901/http://www.securitytracker.com/id/1037331
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-8735
- https://github.com/apache/tomcat
- https://github.com/search?q=repo%3Aapache%2Ftomcat+catalina.mbeans+path%3A%2F%5Eres%5C%2Fbnd%5C%2F%2F&type=code
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2016-8735 · CVE Program
- CVE-2016-8735 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-cw54-59pw-4g8c · GitHub Advisory Database · CC BY 4.0
- CVE-2016-8735 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences