GitHub Advisoryadvisory · Maven

GHSA-9hjv-9h75-xmpp Improper Verification of Source of a Communication Channel in Apache Tomcat

MEDIUM Published 2022-05-14 Modified 2024-02-22 Official page ↗
Aliases
CVE-2016-0763
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-940
Reviewed
2022-07-06

Affected packages

• Maven org.apache.tomcat:tomcat: >= 7.0.0, < 7.0.68 → fixed in 7.0.68 • Maven org.apache.tomcat:tomcat: >= 8.0.0, < 8.0.32 → fixed in 8.0.32 • Maven org.apache.tomcat:tomcat: >= 9.0.0M1, < 9.0.0.M3 → fixed in 9.0.0.M3

Description

The `setGlobalContext` method in `org/apache/naming/factory/ResourceLinkFactory.java` in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.

Related

Alias · CVE (1)

  • CVE-2016-0763 The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31,… vulnerability

Weakness · CWE (1)

  • CWE-940 Improper Verification of Source of a Communication Channel weakness

References