Yüksek CVSS 8.8

CVE-2016-0714: Tomcat: güvenlik açığı

Yayın: 25 Şubat 2016 03:59 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.

Özet bilgiler

Ürün: Apache Tomcat
CVSS v3.1: 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: %13,08 (yüzdelik 96)
CWE: CWE-264
Yama: Yok / bilinmiyor

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
apache-tomcat	6.0.0	6.0.0	—
apache-tomcat	6.0.0	6.0.0	—
apache-tomcat	6.0.1	6.0.1	—
apache-tomcat	6.0.1	6.0.1	—
apache-tomcat	6.0.2	6.0.2	—
apache-tomcat	6.0.2	6.0.2	—
apache-tomcat	6.0.2	6.0.2	—
apache-tomcat	6.0.4	6.0.4	—
apache-tomcat	6.0.4	6.0.4	—
apache-tomcat	6.0.10	6.0.10	—
apache-tomcat	6.0.11	6.0.11	—
apache-tomcat	6.0.13	6.0.13	—
apache-tomcat	6.0.14	6.0.14	—
apache-tomcat	6.0.16	6.0.16	—
apache-tomcat	6.0.18	6.0.18	—
apache-tomcat	6.0.20	6.0.20	—
apache-tomcat	6.0.24	6.0.24	—
apache-tomcat	6.0.26	6.0.26	—
apache-tomcat	6.0.28	6.0.28	—
apache-tomcat	6.0.29	6.0.29	—
apache-tomcat	6.0.30	6.0.30	—
apache-tomcat	6.0.32	6.0.32	—
apache-tomcat	6.0.33	6.0.33	—
apache-tomcat	6.0.35	6.0.35	—
apache-tomcat	6.0.36	6.0.36	—
apache-tomcat	6.0.37	6.0.37	—
apache-tomcat	6.0.39	6.0.39	—
apache-tomcat	6.0.41	6.0.41	—
apache-tomcat	6.0.43	6.0.43	—
apache-tomcat	6.0.44	6.0.44	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları