CVE-2014-7810: Improper Access Control in Apache Tomcat
Summary
CVE-2014-7810: Improper Access Control in Apache Tomcat. Affects org.apache.tomcat:tomcat across 3 version ranges.
>= 6.0.0, < 6.0.44
>= 7.0.0, < 7.0.58
>= 8.0.0, < 8.0.16
Fixed in 6.0.44, 7.0.58 or 8.0.16, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to serve Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications. The vulnerability identified as CVE-2014-7810 affects Apache Tomcat versions 6.x, 7.x, and 8.x. This vulnerability is related to the Expression Language (EL) implementation in Apache Tomcat. The EL implementation does not properly consider the possibility of an accessible interface implemented by an inaccessible class. This flaw can be exploited by attackers to bypass the SecurityManager protection mechanism through a web application that leverages incorrect privileges during EL evaluation.
Vulnerability Detail
The vulnerability in Apache Tomcat allows attackers to bypass the SecurityManager protection mechanism. By exploiting this vulnerability, an attacker can gain unauthorized access to resources and perform actions that should be restricted. This can lead to various security risks, such as unauthorized data access, privilege escalation, and remote code execution. The vulnerability is considered moderate in severity and is assigned CWE-284.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 6.0.0, < 6.0.446.0.44 -
>= 7.0.0, < 7.0.587.0.58 -
>= 8.0.0, < 8.0.168.0.16
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed versions of Apache Tomcat as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in Apache Tomcat allows attackers to bypass the SecurityManager protection mechanism and gain unauthorized access to resources. To mitigate this vulnerability, it is recommended to upgrade to the fixed versions of Apache Tomcat. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to serve Java-based web applications.
This vulnerability allows attackers to bypass the SecurityManager protection mechanism and gain unauthorized access to resources, potentially leading to unauthorized data access, privilege escalation, and remote code execution.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Apache Tomcat as mentioned in the 'how_to_fix' section.
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed versions of Apache Tomcat.
This vulnerability is considered moderate in severity.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
