4.3

CVE-2016-0706

Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.

Data is provided by the National Vulnerability Database (NVD)
Canonical ≫ Ubuntu Linux Version12.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version15.10
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Debian ≫ Debian Linux Version7.0
Debian ≫ Debian Linux Version8.0
Apache ≫ Tomcat Version6.0.0
Apache ≫ Tomcat Version6.0.0 Updatealpha
Apache ≫ Tomcat Version6.0.1
Apache ≫ Tomcat Version6.0.1 Updatealpha
Apache ≫ Tomcat Version6.0.2
Apache ≫ Tomcat Version6.0.2 Updatealpha
Apache ≫ Tomcat Version6.0.2 Updatebeta
Apache ≫ Tomcat Version6.0.4
Apache ≫ Tomcat Version6.0.4 Updatealpha
Apache ≫ Tomcat Version6.0.10
Apache ≫ Tomcat Version6.0.11
Apache ≫ Tomcat Version6.0.13
Apache ≫ Tomcat Version6.0.14
Apache ≫ Tomcat Version6.0.16
Apache ≫ Tomcat Version6.0.18
Apache ≫ Tomcat Version6.0.20
Apache ≫ Tomcat Version6.0.24
Apache ≫ Tomcat Version6.0.26
Apache ≫ Tomcat Version6.0.28
Apache ≫ Tomcat Version6.0.29
Apache ≫ Tomcat Version6.0.30
Apache ≫ Tomcat Version6.0.32
Apache ≫ Tomcat Version6.0.33
Apache ≫ Tomcat Version6.0.35
Apache ≫ Tomcat Version6.0.36
Apache ≫ Tomcat Version6.0.37
Apache ≫ Tomcat Version6.0.39
Apache ≫ Tomcat Version6.0.41
Apache ≫ Tomcat Version6.0.43
Apache ≫ Tomcat Version6.0.44
Apache ≫ Tomcat Version7.0.0 Updatebeta
Apache ≫ Tomcat Version7.0.2 Updatebeta
Apache ≫ Tomcat Version7.0.4 Updatebeta
Apache ≫ Tomcat Version7.0.5 Updatebeta
Apache ≫ Tomcat Version7.0.6
Apache ≫ Tomcat Version7.0.10
Apache ≫ Tomcat Version7.0.11
Apache ≫ Tomcat Version7.0.12
Apache ≫ Tomcat Version7.0.14
Apache ≫ Tomcat Version7.0.16
Apache ≫ Tomcat Version7.0.19
Apache ≫ Tomcat Version7.0.20
Apache ≫ Tomcat Version7.0.21
Apache ≫ Tomcat Version7.0.22
Apache ≫ Tomcat Version7.0.23
Apache ≫ Tomcat Version7.0.25
Apache ≫ Tomcat Version7.0.26
Apache ≫ Tomcat Version7.0.27
Apache ≫ Tomcat Version7.0.28
Apache ≫ Tomcat Version7.0.29
Apache ≫ Tomcat Version7.0.30
Apache ≫ Tomcat Version7.0.32
Apache ≫ Tomcat Version7.0.33
Apache ≫ Tomcat Version7.0.34
Apache ≫ Tomcat Version7.0.35
Apache ≫ Tomcat Version7.0.37
Apache ≫ Tomcat Version7.0.39
Apache ≫ Tomcat Version7.0.40
Apache ≫ Tomcat Version7.0.41
Apache ≫ Tomcat Version7.0.42
Apache ≫ Tomcat Version7.0.47
Apache ≫ Tomcat Version7.0.50
Apache ≫ Tomcat Version7.0.52
Apache ≫ Tomcat Version7.0.53
Apache ≫ Tomcat Version7.0.54
Apache ≫ Tomcat Version7.0.55
Apache ≫ Tomcat Version7.0.56
Apache ≫ Tomcat Version7.0.57
Apache ≫ Tomcat Version7.0.59
Apache ≫ Tomcat Version7.0.61
Apache ≫ Tomcat Version7.0.62
Apache ≫ Tomcat Version7.0.63
Apache ≫ Tomcat Version7.0.64
Apache ≫ Tomcat Version7.0.65
Apache ≫ Tomcat Version7.0.67
Apache ≫ Tomcat Version8.0.0 Updaterc1
Apache ≫ Tomcat Version8.0.0 Updaterc10
Apache ≫ Tomcat Version8.0.0 Updaterc3
Apache ≫ Tomcat Version8.0.0 Updaterc5
Apache ≫ Tomcat Version8.0.1
Apache ≫ Tomcat Version8.0.3
Apache ≫ Tomcat Version8.0.11
Apache ≫ Tomcat Version8.0.12
Apache ≫ Tomcat Version8.0.14
Apache ≫ Tomcat Version8.0.15
Apache ≫ Tomcat Version8.0.17
Apache ≫ Tomcat Version8.0.18
Apache ≫ Tomcat Version8.0.20
Apache ≫ Tomcat Version8.0.21
Apache ≫ Tomcat Version8.0.22
Apache ≫ Tomcat Version8.0.23
Apache ≫ Tomcat Version8.0.24
Apache ≫ Tomcat Version8.0.26
Apache ≫ Tomcat Version8.0.27
Apache ≫ Tomcat Version8.0.28
Apache ≫ Tomcat Version8.0.29
Apache ≫ Tomcat Version8.0.30
Apache ≫ Tomcat Version9.0.0 Updatemilestone1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.62% 0.692
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://www.debian.org/security/2016/dsa-3530
Third Party Advisory
Mailing List