7.5

CVE-2016-6797

The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Tomcat Version >= 6.0.0 <= 6.0.45
Apache ≫ Tomcat Version >= 7.0.0 <= 7.0.70
Apache ≫ Tomcat Version >= 8.0 <= 8.0.36
Apache ≫ Tomcat Version >= 8.5.0 <= 8.5.4
Apache ≫ Tomcat Version9.0.0 Updatemilestone1
Apache ≫ Tomcat Version9.0.0 Updatemilestone2
Apache ≫ Tomcat Version9.0.0 Updatemilestone3
Apache ≫ Tomcat Version9.0.0 Updatemilestone4
Apache ≫ Tomcat Version9.0.0 Updatemilestone5
Apache ≫ Tomcat Version9.0.0 Updatemilestone6
Apache ≫ Tomcat Version9.0.0 Updatemilestone7
Apache ≫ Tomcat Version9.0.0 Updatemilestone8
Apache ≫ Tomcat Version9.0.0 Updatemilestone9
Oracle ≫ Tekelec Platform Distribution Version >= 7.4.0 <= 7.7.1
Debian ≫ Debian Linux Version8.0
Netapp ≫ Oncommand Insight Version-
Netapp ≫ Oncommand Shift Version-
Canonical ≫ Ubuntu Linux Version16.04 SwEditionesm
Redhat ≫ Enterprise Linux Eus Version7.4
Redhat ≫ Enterprise Linux Eus Version7.5
Redhat ≫ Enterprise Linux Eus Version7.6
Redhat ≫ Enterprise Linux Eus Version7.7
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.4% 0.598
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://usn.ubuntu.com/4557-1/
Third Party Advisory