CVE-2016-8735

Warnung

EPSS 93.9%
Veröffentlicht 06.04.2017 21:59:00
Zuletzt bearbeitet 20.04.2025 01:37:25
Quelle security@apache.org
Teams Watchlist Login
Unerledigt Login

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

Betroffene Produkte Warnungen 1 Metriken 4 CWE 0 Referenzen 39

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Apache ≫ Tomcat Version < 6.0.48

Apache ≫ Tomcat Version >= 7.0.0 < 7.0.73

Apache ≫ Tomcat Version >= 8.0 < 8.0.39

Apache ≫ Tomcat Version >= 8.5.0 < 8.5.7

Apache ≫ Tomcat Version9.0.0 Update-

Apache ≫ Tomcat Version9.0.0 Updatemilestone1

Apache ≫ Tomcat Version9.0.0 Updatemilestone10

Apache ≫ Tomcat Version9.0.0 Updatemilestone11

Apache ≫ Tomcat Version9.0.0 Updatemilestone2

Apache ≫ Tomcat Version9.0.0 Updatemilestone3

Apache ≫ Tomcat Version9.0.0 Updatemilestone4

Apache ≫ Tomcat Version9.0.0 Updatemilestone5

Apache ≫ Tomcat Version9.0.0 Updatemilestone6

Apache ≫ Tomcat Version9.0.0 Updatemilestone7

Apache ≫ Tomcat Version9.0.0 Updatemilestone8

Apache ≫ Tomcat Version9.0.0 Updatemilestone9

Canonical ≫ Ubuntu Linux Version16.04 SwEditionesm

Netapp ≫ 7-mode Transition Tool Version-

Netapp ≫ Oncommand Insight Version-

Netapp ≫ Oncommand Shift Version-

Netapp ≫ Snap Creator Framework Version-

Debian ≫ Debian Linux Version8.0

Redhat ≫ Jboss Enterprise Web Server Version3.0.0

Oracle ≫ Agile Engineering Data Management Version6.1.3

Oracle ≫ Agile Engineering Data Management Version6.2.0

Oracle ≫ Agile Engineering Data Management Version6.2.1.0

Oracle ≫ Agile Plm Version9.3.5

Oracle ≫ Agile Plm Version9.3.6

Oracle ≫ Communications Application Session Controller Version3.7.1

Oracle ≫ Communications Application Session Controller Version3.8.0

Oracle ≫ Communications Instant Messaging Server Version10.0.1

Oracle ≫ Communications Interactive Session Recorder Version6.0

Oracle ≫ Communications Interactive Session Recorder Version6.1

Oracle ≫ Communications Interactive Session Recorder Version6.2

Oracle ≫ Hospitality Guest Access Version4.2.0

Oracle ≫ Hospitality Guest Access Version4.2.1

Oracle ≫ Micros Relate Crm Software Version10.8

Oracle ≫ Micros Relate Crm Software Version11.4

Oracle ≫ Micros Retail Xbri Loss Prevention Version10.0.1

Oracle ≫ Micros Retail Xbri Loss Prevention Version10.5.0

Oracle ≫ Micros Retail Xbri Loss Prevention Version10.6.0

Oracle ≫ Micros Retail Xbri Loss Prevention Version10.7.7

Oracle ≫ Micros Retail Xbri Loss Prevention Version10.8.0

Oracle ≫ Micros Retail Xbri Loss Prevention Version10.8.1

Oracle ≫ Mysql Enterprise Monitor Version <= 3.2.8.2223

Oracle ≫ Mysql Enterprise Monitor Version >= 3.3.0 <= 3.3.4.3247

Oracle ≫ Mysql Enterprise Monitor Version >= 3.4.0 <= 3.4.2.4181

Oracle ≫ Retail Convenience And Fuel Pos Software Version2.1.132

Oracle ≫ Transportation Management Version6.3.0

Oracle ≫ Transportation Management Version6.3.1

Oracle ≫ Transportation Management Version6.3.2

Oracle ≫ Transportation Management Version6.3.3

Oracle ≫ Transportation Management Version6.3.4

Oracle ≫ Transportation Management Version6.3.5

Oracle ≫ Transportation Management Version6.3.6

Oracle ≫ Transportation Management Version6.3.7

12.05.2023: CISA Known Exploited Vulnerabilities (KEV) Catalog

Apache Tomcat Remote Code Execution Vulnerability

Schwachstelle

Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	93.9%	0.999

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P
134c704f-9b21-4f2e-91b3-4a467353bcc0	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H