Apache Tomcat Improper Access Control vulnerability
Critical severity
GitHub Reviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated May 10, 2024
Package
Affected versions
< 6.0.48
>= 7.0.0, < 7.0.73
>= 8.0.0, < 8.0.39
>= 8.5.0, < 8.5.7
>= 9.0.0.M1, < 9.0.0.M12
Patched versions
6.0.48
7.0.73
8.0.39
8.5.7
9.0.0.M12
< 6.0.48
>= 7.0.0, < 7.0.73
>= 8.0.0, < 8.0.39
>= 8.5.0, < 8.5.7
>= 9.0.0.M1, < 9.0.0.M12
6.0.48
7.0.73
8.0.39
8.5.7
9.0.0.M12
Description
Published by the National Vulnerability Database
Apr 6, 2017
Published to the GitHub Advisory Database
May 13, 2022
Reviewed
Dec 8, 2023
Last updated
May 10, 2024
Credits
-
sunSUNQ Analyst
-
westonsteimel Analyst
-
liususan091219 Analyst
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports.
The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
References