CVEvulnerability

CVE-2016-6797

7.5 HIGH Published 2017-08-10 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2017-08-10
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-863

Description

The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.

Affected configurations

• apache tomcat (>= 6.0.0 <= 6.0.45) • apache tomcat (>= 7.0.0 <= 7.0.70) • apache tomcat (>= 8.0 <= 8.0.36) • apache tomcat (>= 8.5.0 <= 8.5.4) • apache tomcat 9.0.0 • oracle tekelec platform distribution (>= 7.4.0 <= 7.7.1) • debian debian linux 8.0 • netapp oncommand insight • netapp oncommand shift • netapp snap creator framework • canonical ubuntu linux 16.04 • redhat jboss enterprise web server 3.0.0 • redhat enterprise linux desktop 7.0 • redhat enterprise linux eus 7.4 • redhat enterprise linux eus 7.5 • redhat enterprise linux eus 7.6 • redhat enterprise linux eus 7.7 • redhat enterprise linux server 7.0 • redhat enterprise linux server aus 7.4 • redhat enterprise linux server aus 7.6 • redhat enterprise linux server aus 7.7 • redhat enterprise linux server tus 7.6 • redhat enterprise linux server tus 7.7 • redhat enterprise linux workstation 7.0

Related

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References