Paper/Archive/CVE-2016-5018

CVE-2016-5018

Apache Software Foundation Apache Tomcat — In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web applicati…

EPSS 10%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (NVD)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 95.7.957 × 2019.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.

Affected

ProductAffectedFixed inSource

Apache Tomcat9.0.0.M1 to 9.0.0.M9–CNA

Apache Tomcat8.5.0 to 8.5.4–CNA

Apache Tomcat8.0.0.RC1 to 8.0.36–CNA

Apache Tomcat7.0.0 to 7.0.70–CNA

Apache Tomcat6.0.0 to 6.0.45–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References