6.5

CVE-2016-0763

The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version7.0
Debian ≫ Debian Linux Version8.0
Apache ≫ Tomcat Version7.0.0 Updatebeta
Apache ≫ Tomcat Version7.0.2 Updatebeta
Apache ≫ Tomcat Version7.0.4 Updatebeta
Apache ≫ Tomcat Version7.0.5 Updatebeta
Apache ≫ Tomcat Version7.0.6
Apache ≫ Tomcat Version7.0.10
Apache ≫ Tomcat Version7.0.11
Apache ≫ Tomcat Version7.0.12
Apache ≫ Tomcat Version7.0.14
Apache ≫ Tomcat Version7.0.16
Apache ≫ Tomcat Version7.0.19
Apache ≫ Tomcat Version7.0.20
Apache ≫ Tomcat Version7.0.21
Apache ≫ Tomcat Version7.0.22
Apache ≫ Tomcat Version7.0.23
Apache ≫ Tomcat Version7.0.25
Apache ≫ Tomcat Version7.0.26
Apache ≫ Tomcat Version7.0.27
Apache ≫ Tomcat Version7.0.28
Apache ≫ Tomcat Version7.0.29
Apache ≫ Tomcat Version7.0.30
Apache ≫ Tomcat Version7.0.32
Apache ≫ Tomcat Version7.0.33
Apache ≫ Tomcat Version7.0.34
Apache ≫ Tomcat Version7.0.35
Apache ≫ Tomcat Version7.0.37
Apache ≫ Tomcat Version7.0.39
Apache ≫ Tomcat Version7.0.40
Apache ≫ Tomcat Version7.0.41
Apache ≫ Tomcat Version7.0.42
Apache ≫ Tomcat Version7.0.47
Apache ≫ Tomcat Version7.0.50
Apache ≫ Tomcat Version7.0.52
Apache ≫ Tomcat Version7.0.53
Apache ≫ Tomcat Version7.0.54
Apache ≫ Tomcat Version7.0.55
Apache ≫ Tomcat Version7.0.56
Apache ≫ Tomcat Version7.0.57
Apache ≫ Tomcat Version7.0.59
Apache ≫ Tomcat Version7.0.61
Apache ≫ Tomcat Version7.0.62
Apache ≫ Tomcat Version7.0.63
Apache ≫ Tomcat Version7.0.64
Apache ≫ Tomcat Version7.0.65
Apache ≫ Tomcat Version7.0.67
Apache ≫ Tomcat Version8.0.0 Updaterc1
Apache ≫ Tomcat Version8.0.0 Updaterc10
Apache ≫ Tomcat Version8.0.0 Updaterc3
Apache ≫ Tomcat Version8.0.0 Updaterc5
Apache ≫ Tomcat Version8.0.1
Apache ≫ Tomcat Version8.0.3
Apache ≫ Tomcat Version8.0.11
Apache ≫ Tomcat Version8.0.12
Apache ≫ Tomcat Version8.0.14
Apache ≫ Tomcat Version8.0.15
Apache ≫ Tomcat Version8.0.17
Apache ≫ Tomcat Version8.0.18
Apache ≫ Tomcat Version8.0.20
Apache ≫ Tomcat Version8.0.21
Apache ≫ Tomcat Version8.0.22
Apache ≫ Tomcat Version8.0.23
Apache ≫ Tomcat Version8.0.24
Apache ≫ Tomcat Version8.0.26
Apache ≫ Tomcat Version8.0.27
Apache ≫ Tomcat Version8.0.28
Apache ≫ Tomcat Version8.0.29
Apache ≫ Tomcat Version8.0.30
Apache ≫ Tomcat Version9.0.0 Updatemilestone1
Canonical ≫ Ubuntu Linux Version12.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version15.10
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 11.3% 0.954
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.3 2.8 3.4
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
nvd@nist.gov 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
http://tomcat.apache.org/security-7.html
Vendor Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
http://tomcat.apache.org/security-8.html
Vendor Advisory
http://www.debian.org/security/2016/dsa-3530
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
http://www.debian.org/security/2016/dsa-3552
http://rhn.redhat.com/errata/RHSA-2016-1089.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html
http://rhn.redhat.com/errata/RHSA-2016-2599.html
http://www.debian.org/security/2016/dsa-3609
http://www.ubuntu.com/usn/USN-3024-1
https://bto.bluecoat.com/security-advisory/sa118
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626
https://security.gentoo.org/glsa/201705-09
https://security.netapp.com/advisory/ntap-20180531-0001/
http://tomcat.apache.org/security-9.html
Vendor Advisory
https://access.redhat.com/errata/RHSA-2016:1087
https://access.redhat.com/errata/RHSA-2016:1088
http://rhn.redhat.com/errata/RHSA-2016-2807.html
http://rhn.redhat.com/errata/RHSA-2016-2808.html
http://www.securitytracker.com/id/1035069
http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179356.html
http://seclists.org/bugtraq/2016/Feb/147
http://svn.apache.org/viewvc?view=revision&revision=1725926
http://svn.apache.org/viewvc?view=revision&revision=1725929
http://svn.apache.org/viewvc?view=revision&revision=1725931
http://www.securityfocus.com/bid/83326
https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E