rewindex

RewindexCVEs

CVE-2016-8735: Apache Tomcat Remote Code Execution Vulnerability

Critical · CVSS 9.8 (CVSS 3.1)KEV known exploitedEPSS 90.3%, 100th percentilePublished Updated Assigner: apache

In CISA’s Known Exploited Vulnerabilities catalog: Apache Tomcat Remote Code Execution Vulnerability.

Added , federal remediation due . Known ransomware use: Unknown.

Required action: Apply updates per vendor instructions.

Description

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

Apache Software Foundation: Apache Tomcat

References

All CVEsMarkdownJSON