7.5high
CVE-2016-6797
Incorrect Authorization in Apache Tomcat
Also known as GHSA-q6x7-f33r-3wxx
Published 9 y ago · modified 29 d ago · JSON
CVSS
7.5
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
8.1%
percentile 95%
Public exploits
0
none known
Summary
The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 29 d ago
Exploit prediction (EPSS)
8.07% probability of exploitation in the next 30 days, higher than 95% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.tomcat:tomcat | >=9.0.0.M1, <9.0.0.M10 >=8.5.0, <8.5.5 >=8.0.0, <8.0.37 >=7.0.0, <7.0.72 | 9.0.0.M10 8.5.5 8.0.37 7.0.72 |
Affected products
- Apache Software Foundation Apache Tomcat
Classification
- Weakness
- CWE-863 Incorrect Authorization
References
- securityfocus.com /bid/93940 · vdb-entry, x_refsource_BID, x_transferred
- lists.apache.org /thread.html/9325837eb00cba5752c092047433c7f0415134d16e7f391447ff4352%40%3Cannounce.tomcat · mailing-list, x_refsource_MLIST, x_transferred
- securitytracker.com /id/1037145 · vdb-entry, x_refsource_SECTRACK, x_transferred
- access.redhat.com /errata/RHSA-2017:2247 · vendor-advisory, x_refsource_REDHAT, x_transferred
- rhn.redhat.com /errata/RHSA-2017-0457.html · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2017:0455 · vendor-advisory, x_refsource_REDHAT, x_transferred
- debian.org /security/2016/dsa-3720 · vendor-advisory, x_refsource_DEBIAN, x_transferred
- access.redhat.com /errata/RHSA-2017:0456 · vendor-advisory, x_refsource_REDHAT, x_transferred
- lists.apache.org /thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
- usn.ubuntu.com /4557-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
- security.netapp.com /advisory/ntap-20180605-0001/ · x_refsource_CONFIRM, x_transferred
- oracle.com /security-alerts/cpuoct2021.html · x_refsource_MISC, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2016-6797 · advisory
- github.com /apache/tomcat/commit/2859ac3eae132383cb6f3f2042e25d7a4a281b0d · web
- github.com /apache/tomcat/commit/b3406e6c318378cbf440f902f9fdbb8b440aef4e · web
- github.com /apache/tomcat/commit/d6b5600afe75e1086dd564344e1d085966e4237d · web
- github.com /apache/tomcat80/commit/824c7dc781056442046db0ae34bcf1497f23f44c · web
- lists.apache.org /thread.html/9325837eb00cba5752c092047433c7f0415134d16e7f391447ff4352@%3Cannounce.tomcat.a · web
- lists.apache.org /thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache · web
- lists.apache.org /thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache · web
- lists.apache.org /thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache · web
- lists.apache.org /thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apach · web
- lists.apache.org /thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apach · web
- lists.apache.org /thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apach · web
- security.netapp.com /advisory/ntap-20180605-0001 · web
- usn.ubuntu.com /4557-1 · web
- web.archive.org /web/20170320064509/http://www.securitytracker.com/id/1037145 · web
- web.archive.org /web/20170423095945/http://www.securityfocus.com/bid/93940 · web
- github.com /apache/tomcat · package
- lists.apache.org /thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache · web
- lists.apache.org /thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache · web
- lists.apache.org /thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache · web
- lists.apache.org /thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache · web
- lists.apache.org /thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache · web
- lists.apache.org /thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache · web
Sources
- CVE List: CVE-2016-6797
- GitHub Advisory: GHSA-q6x7-f33r-3wxx
- NVD: CVE-2016-6797
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.