GHSA-3mjp-p938-4329HighCVSS 7.5

Apache Tomcat vulnerable to SecurityManager bypass

Published
May 13, 2022
Last Modified
March 2, 2024

🔗 CVE IDs covered (1)

CVE-2016-6796 →

📋 Description

A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.

🎯 Affected products5

  • maven/org.apache.tomcat:tomcat:>= 9.0.0.M1, <= 9.0.0.M9
  • maven/org.apache.tomcat:tomcat:>= 8.5.0, <= 8.5.4
  • maven/org.apache.tomcat:tomcat:>= 8.0.0.RC1, <= 8.0.36
  • maven/org.apache.tomcat:tomcat:>= 7.0.0, <= 7.0.70
  • maven/org.apache.tomcat:tomcat:>= 6.0.0, <= 6.0.45

🔗 References (52)