7.1

CVE-2016-6816

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Tomcat Version 6.0.0
Apache ≫ Tomcat Version 6.0.1
Apache ≫ Tomcat Version 6.0.2
Apache ≫ Tomcat Version 6.0.3
Apache ≫ Tomcat Version 6.0.4
Apache ≫ Tomcat Version 6.0.5
Apache ≫ Tomcat Version 6.0.6
Apache ≫ Tomcat Version 6.0.7
Apache ≫ Tomcat Version 6.0.8
Apache ≫ Tomcat Version 6.0.9
Apache ≫ Tomcat Version 6.0.10
Apache ≫ Tomcat Version 6.0.11
Apache ≫ Tomcat Version 6.0.12
Apache ≫ Tomcat Version 6.0.13
Apache ≫ Tomcat Version 6.0.14
Apache ≫ Tomcat Version 6.0.15
Apache ≫ Tomcat Version 6.0.16
Apache ≫ Tomcat Version 6.0.17
Apache ≫ Tomcat Version 6.0.18
Apache ≫ Tomcat Version 6.0.19
Apache ≫ Tomcat Version 6.0.20
Apache ≫ Tomcat Version 6.0.21
Apache ≫ Tomcat Version 6.0.22
Apache ≫ Tomcat Version 6.0.23
Apache ≫ Tomcat Version 6.0.24
Apache ≫ Tomcat Version 6.0.25
Apache ≫ Tomcat Version 6.0.26
Apache ≫ Tomcat Version 6.0.27
Apache ≫ Tomcat Version 6.0.28
Apache ≫ Tomcat Version 6.0.29
Apache ≫ Tomcat Version 6.0.30
Apache ≫ Tomcat Version 6.0.31
Apache ≫ Tomcat Version 6.0.32
Apache ≫ Tomcat Version 6.0.33
Apache ≫ Tomcat Version 6.0.34
Apache ≫ Tomcat Version 6.0.35
Apache ≫ Tomcat Version 6.0.36
Apache ≫ Tomcat Version 6.0.37
Apache ≫ Tomcat Version 6.0.38
Apache ≫ Tomcat Version 6.0.39
Apache ≫ Tomcat Version 6.0.40
Apache ≫ Tomcat Version 6.0.41
Apache ≫ Tomcat Version 6.0.42
Apache ≫ Tomcat Version 6.0.43
Apache ≫ Tomcat Version 6.0.44
Apache ≫ Tomcat Version 6.0.45
Apache ≫ Tomcat Version 6.0.46
Apache ≫ Tomcat Version 6.0.47
Apache ≫ Tomcat Version 7.0.0
Apache ≫ Tomcat Version 7.0.1
Apache ≫ Tomcat Version 7.0.2
Apache ≫ Tomcat Version 7.0.3
Apache ≫ Tomcat Version 7.0.4
Apache ≫ Tomcat Version 7.0.5
Apache ≫ Tomcat Version 7.0.6
Apache ≫ Tomcat Version 7.0.7
Apache ≫ Tomcat Version 7.0.8
Apache ≫ Tomcat Version 7.0.9
Apache ≫ Tomcat Version 7.0.10
Apache ≫ Tomcat Version 7.0.11
Apache ≫ Tomcat Version 7.0.12
Apache ≫ Tomcat Version 7.0.13
Apache ≫ Tomcat Version 7.0.14
Apache ≫ Tomcat Version 7.0.15
Apache ≫ Tomcat Version 7.0.16
Apache ≫ Tomcat Version 7.0.17
Apache ≫ Tomcat Version 7.0.18
Apache ≫ Tomcat Version 7.0.19
Apache ≫ Tomcat Version 7.0.20
Apache ≫ Tomcat Version 7.0.21
Apache ≫ Tomcat Version 7.0.22
Apache ≫ Tomcat Version 7.0.23
Apache ≫ Tomcat Version 7.0.24
Apache ≫ Tomcat Version 7.0.25
Apache ≫ Tomcat Version 7.0.26
Apache ≫ Tomcat Version 7.0.27
Apache ≫ Tomcat Version 7.0.28
Apache ≫ Tomcat Version 7.0.29
Apache ≫ Tomcat Version 7.0.30
Apache ≫ Tomcat Version 7.0.31
Apache ≫ Tomcat Version 7.0.32
Apache ≫ Tomcat Version 7.0.33
Apache ≫ Tomcat Version 7.0.34
Apache ≫ Tomcat Version 7.0.35
Apache ≫ Tomcat Version 7.0.36
Apache ≫ Tomcat Version 7.0.37
Apache ≫ Tomcat Version 7.0.38
Apache ≫ Tomcat Version 7.0.39
Apache ≫ Tomcat Version 7.0.40
Apache ≫ Tomcat Version 7.0.41
Apache ≫ Tomcat Version 7.0.42
Apache ≫ Tomcat Version 7.0.43
Apache ≫ Tomcat Version 7.0.44
Apache ≫ Tomcat Version 7.0.45
Apache ≫ Tomcat Version 7.0.46
Apache ≫ Tomcat Version 7.0.47
Apache ≫ Tomcat Version 7.0.48
Apache ≫ Tomcat Version 7.0.49
Apache ≫ Tomcat Version 7.0.50
Apache ≫ Tomcat Version 7.0.51
Apache ≫ Tomcat Version 7.0.52
Apache ≫ Tomcat Version 7.0.53
Apache ≫ Tomcat Version 7.0.54
Apache ≫ Tomcat Version 7.0.55
Apache ≫ Tomcat Version 7.0.56
Apache ≫ Tomcat Version 7.0.57
Apache ≫ Tomcat Version 7.0.58
Apache ≫ Tomcat Version 7.0.59
Apache ≫ Tomcat Version 7.0.60
Apache ≫ Tomcat Version 7.0.61
Apache ≫ Tomcat Version 7.0.62
Apache ≫ Tomcat Version 7.0.63
Apache ≫ Tomcat Version 7.0.64
Apache ≫ Tomcat Version 7.0.65
Apache ≫ Tomcat Version 7.0.66
Apache ≫ Tomcat Version 7.0.67
Apache ≫ Tomcat Version 7.0.68
Apache ≫ Tomcat Version 7.0.69
Apache ≫ Tomcat Version 7.0.70
Apache ≫ Tomcat Version 7.0.71
Apache ≫ Tomcat Version 7.0.72
Apache ≫ Tomcat Version 8.0.0
Apache ≫ Tomcat Version 8.0.1
Apache ≫ Tomcat Version 8.0.2
Apache ≫ Tomcat Version 8.0.3
Apache ≫ Tomcat Version 8.0.4
Apache ≫ Tomcat Version 8.0.5
Apache ≫ Tomcat Version 8.0.6
Apache ≫ Tomcat Version 8.0.7
Apache ≫ Tomcat Version 8.0.8
Apache ≫ Tomcat Version 8.0.9
Apache ≫ Tomcat Version 8.0.10
Apache ≫ Tomcat Version 8.0.11
Apache ≫ Tomcat Version 8.0.12
Apache ≫ Tomcat Version 8.0.13
Apache ≫ Tomcat Version 8.0.14
Apache ≫ Tomcat Version 8.0.15
Apache ≫ Tomcat Version 8.0.16
Apache ≫ Tomcat Version 8.0.17
Apache ≫ Tomcat Version 8.0.18
Apache ≫ Tomcat Version 8.0.19
Apache ≫ Tomcat Version 8.0.20
Apache ≫ Tomcat Version 8.0.21
Apache ≫ Tomcat Version 8.0.22
Apache ≫ Tomcat Version 8.0.23
Apache ≫ Tomcat Version 8.0.24
Apache ≫ Tomcat Version 8.0.25
Apache ≫ Tomcat Version 8.0.26
Apache ≫ Tomcat Version 8.0.27
Apache ≫ Tomcat Version 8.0.28
Apache ≫ Tomcat Version 8.0.29
Apache ≫ Tomcat Version 8.0.30
Apache ≫ Tomcat Version 8.0.31
Apache ≫ Tomcat Version 8.0.32
Apache ≫ Tomcat Version 8.0.33
Apache ≫ Tomcat Version 8.0.34
Apache ≫ Tomcat Version 8.0.35
Apache ≫ Tomcat Version 8.0.36
Apache ≫ Tomcat Version 8.0.37
Apache ≫ Tomcat Version 8.0.38
Apache ≫ Tomcat Version 8.5.0
Apache ≫ Tomcat Version 8.5.1
Apache ≫ Tomcat Version 8.5.2
Apache ≫ Tomcat Version 8.5.3
Apache ≫ Tomcat Version 8.5.4
Apache ≫ Tomcat Version 8.5.5
Apache ≫ Tomcat Version 8.5.6
Apache ≫ Tomcat Version 9.0.0 Update milestone1
Apache ≫ Tomcat Version 9.0.0 Update milestone10
Apache ≫ Tomcat Version 9.0.0 Update milestone11
Apache ≫ Tomcat Version 9.0.0 Update milestone2
Apache ≫ Tomcat Version 9.0.0 Update milestone3
Apache ≫ Tomcat Version 9.0.0 Update milestone4
Apache ≫ Tomcat Version 9.0.0 Update milestone5
Apache ≫ Tomcat Version 9.0.0 Update milestone6
Apache ≫ Tomcat Version 9.0.0 Update milestone7
Apache ≫ Tomcat Version 9.0.0 Update milestone8
Apache ≫ Tomcat Version 9.0.0 Update milestone9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 39.63% 0.984
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.1 2.8 3.7
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E
http://rhn.redhat.com/errata/RHSA-2017-0457.html
https://access.redhat.com/errata/RHSA-2017:0455
https://access.redhat.com/errata/RHSA-2017:0456
http://rhn.redhat.com/errata/RHSA-2017-0244.html
http://rhn.redhat.com/errata/RHSA-2017-0245.html
http://rhn.redhat.com/errata/RHSA-2017-0246.html
http://rhn.redhat.com/errata/RHSA-2017-0247.html
http://rhn.redhat.com/errata/RHSA-2017-0250.html
http://rhn.redhat.com/errata/RHSA-2017-0527.html
http://www.debian.org/security/2016/dsa-3738
http://www.securityfocus.com/bid/94461
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1037332
https://access.redhat.com/errata/RHSA-2017:0935
https://security.netapp.com/advisory/ntap-20180607-0001/
https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48
Vendor Advisory
Release Notes
https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73
Vendor Advisory
Release Notes
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39
Vendor Advisory
Release Notes
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8
Vendor Advisory
Release Notes
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.0.M13
Vendor Advisory
Release Notes
https://usn.ubuntu.com/4557-1/
https://www.exploit-db.com/exploits/41783/