GitHub Advisoryadvisory · Maven

GHSA-mv42-px54-87jw Improper Access Control in Apache Tomcat

HIGH Published 2022-05-14 Modified 2024-02-29 Official page ↗
Aliases
CVE-2016-0714
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-284
Reviewed
2022-07-06

Affected packages

• Maven org.apache.tomcat:tomcat: >= 9.0.0.M1, < 9.0.0.M2 → fixed in 9.0.0.M2 • Maven org.apache.tomcat:tomcat: >= 8.0.0.RC1, < 8.0.32 → fixed in 8.0.32 • Maven org.apache.tomcat:tomcat: >= 7.0.0, < 7.0.70 → fixed in 7.0.70 • Maven org.apache.tomcat:tomcat: >= 6.0.0, < 6.0.46 → fixed in 6.0.46

Description

The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.

Related

Alias · CVE (1)

  • CVE-2016-0714 The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References