GitHub Advisoryadvisory · Maven

GHSA-cw54-59pw-4g8c Apache Tomcat Improper Access Control vulnerability

CRITICAL Published 2022-05-13 Modified 2025-10-22 Official page ↗
Aliases
CVE-2016-8735
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat-catalina-jmx-remote, org.apache.tomcat:tomcat-catalina
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weaknesses
CWE-284
Reviewed
2023-12-08

Affected packages

• Maven org.apache.tomcat:tomcat-catalina-jmx-remote: < 6.0.48 → fixed in 6.0.48 • Maven org.apache.tomcat:tomcat-catalina-jmx-remote: >= 7.0.0, < 7.0.73 → fixed in 7.0.73 • Maven org.apache.tomcat:tomcat-catalina-jmx-remote: >= 8.0.0, < 8.0.39 → fixed in 8.0.39 • Maven org.apache.tomcat:tomcat-catalina-jmx-remote: >= 8.5.0, < 8.5.7 → fixed in 8.5.7 • Maven org.apache.tomcat:tomcat-catalina-jmx-remote: >= 9.0.0.M1, < 9.0.0.M12 → fixed in 9.0.0.M12 • Maven org.apache.tomcat:tomcat-catalina: < 6.0.48 → fixed in 6.0.48 • Maven org.apache.tomcat:tomcat-catalina: >= 7.0.0, < 7.0.73 → fixed in 7.0.73 • Maven org.apache.tomcat:tomcat-catalina: >= 8.0.0, < 8.0.39 → fixed in 8.0.39 • Maven org.apache.tomcat:tomcat-catalina: >= 8.5.0, < 8.5.7 → fixed in 8.5.7 • Maven org.apache.tomcat:tomcat-catalina: >= 9.0.0.M1, < 9.0.0.M12 → fixed in 9.0.0.M12

Description

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

Related

Alias · CVE (1)

  • CVE-2016-8735 Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References