Orta CVSS 5.3

CVE-2016-6794: Tomcat: güvenlik açığı

Yayın: 10 Ağustos 2017 19:29 · Güncelleme: 6 Kasım 2026 09:45

Açıklama (NVD)

When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.

Özet bilgiler

Ürün: Apache Tomcat
CVSS v3.1: 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: %7,15 (yüzdelik 94)
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
apache-tomcat	6.0.0	6.0.45	—
apache-tomcat	7.0.0	7.0.70	—
apache-tomcat	8.0	8.0.36	—
apache-tomcat	8.5.0	8.5.4	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
apache-tomcat	9.0.0	9.0.0	—
debian-debian-linux	8.0	8.0	—
redhat-jboss-enterprise-web-server	3.0.0	3.0.0	—
redhat-enterprise-linux-desktop	7.0	7.0	—
redhat-enterprise-linux-eus	7.4	7.4	—
redhat-enterprise-linux-eus	7.5	7.5	—
redhat-enterprise-linux-eus	7.6	7.6	—
redhat-enterprise-linux-eus	7.7	7.7	—
redhat-enterprise-linux-server	7.0	7.0	—
redhat-enterprise-linux-server-aus	7.6	7.6	—
redhat-enterprise-linux-server-aus	7.7	7.7	—
redhat-enterprise-linux-server-tus	7.6	7.6	—
redhat-enterprise-linux-server-tus	7.7	7.7	—
redhat-enterprise-linux-workstation	7.0	7.0	—
netapp-oncommand-insight	—	—	—
netapp-oncommand-shift	—	—	—
netapp-snap-creator-framework	—	—	—
canonical-ubuntu-linux	16.04	16.04	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları