Vulnerabilities

TI-2016-05837 CVE-2016-6796 · GHSA-3mjp-p938-4329

A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to…

MEDIUM 50

A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.08321 Published 2017-08-11 Partial fix · 9.0.0.M10, 8.5.5 +3

TI-2016-05838 CVE-2016-6797 · GHSA-q6x7-f33r-3wxx

Incorrect authorization in Apache Tomcat

MEDIUM 50

The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to thos…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0807 Published 2017-08-10 Partial fix · 9.0.0.M10, 8.5.5 +2 CWE-863

TI-2016-05835 CVE-2016-6794 · GHSA-2rvf-329f-p99g

When a SecurityManager is configured, a web application's ability to read system…

LOW 34

When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.07152 Published 2017-08-10 Partial fix · 6.0.47, 7.0.72 +3

TI-2016-04337 CVE-2016-5018 · GHSA-4v3g-g84w-hv7r

Authentication bypass in Apache Tomcat

MEDIUM 60

In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.10303 Published 2017-08-10 Partial fix · 9.0.0.M10, 8.5.5 +3 CWE-288

TI-2016-00681 CVE-2016-0762 · GHSA-wxcp-f2c8-x6xv

Observable discrepancy in Apache Tomcat

MEDIUM 43

The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not e…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.07991 Published 2017-08-10 Partial fix · 9.0.0.M10, 8.5.5 +3 CWE-203