GHSA-mv42-px54-87jwHighCVSS 8.8

Improper Access Control in Apache Tomcat

Published
May 14, 2022
Last Modified
February 29, 2024

🔗 CVE IDs covered (1)

CVE-2016-0714 →

📋 Description

The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.

🎯 Affected products4

  • maven/org.apache.tomcat:tomcat:= 9.0.0.M1
  • maven/org.apache.tomcat:tomcat:>= 8.0.0.RC1, < 8.0.32
  • maven/org.apache.tomcat:tomcat:>= 7.0.0, < 7.0.70
  • maven/org.apache.tomcat:tomcat:>= 6.0.0, < 6.0.46

🔗 References (67)