CVE-2016-0706: Apache Tomcat Exposure of Sensitive Information
Summary
CVE-2016-0706: Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat. Affects org.apache.tomcat:tomcat across 3 version ranges.
>= 6.0.0, < 6.0.45
>= 8.0.0.RC1, < 8.0.31
>= 9.0.0.M1, < 9.0.0.M2
Fixed in 6.0.45, 8.0.31 or 9.0.0.M2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for deploying Java-based web applications. It provides a robust and scalable platform for running Java web applications. However, versions 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 of Apache Tomcat are vulnerable to an exposure of sensitive information issue. This vulnerability allows remote authenticated users to bypass SecurityManager restrictions and read arbitrary HTTP requests, potentially leading to the discovery of session ID values.
Vulnerability Detail
The vulnerability in Apache Tomcat arises from the absence of the org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list. This omission enables remote authenticated users to bypass intended SecurityManager restrictions and gain access to arbitrary HTTP requests. By exploiting this vulnerability, an attacker can potentially discover session ID values, which may lead to session hijacking or other security breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.0.0, < 6.0.456.0.45 -
>= 8.0.0.RC1, < 8.0.318.0.31 -
>= 9.0.0.M1, < 9.0.0.M29.0.0.M2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can manually add the org.apache.catalina.manager.StatusManagerServlet to the org/apache/catalina/core/RestrictedServlets.properties list. This can be done by modifying the configuration files of Apache Tomcat. However, it is strongly recommended to apply the official fix by upgrading to a fixed version rather than relying on workarounds.
Conclusion
The exposure of sensitive information vulnerability in Apache Tomcat can be mitigated by upgrading to the fixed versions mentioned above. Regularly updating Apache Tomcat is crucial to ensure the latest security patches are applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container used for deploying Java-based web applications.
Versions 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 of Apache Tomcat are affected by this vulnerability.
This vulnerability allows remote authenticated users to bypass SecurityManager restrictions and read arbitrary HTTP requests, potentially leading to the discovery of session ID values.
To fix this vulnerability, it is recommended to upgrade to a fixed version of Apache Tomcat. Details on the specific versions to upgrade to can be found in the 'how_to_fix' section.
Yes, a workaround is available by manually adding the org.apache.catalina.manager.StatusManagerServlet to the org/apache/catalina/core/RestrictedServlets.properties list. However, it is recommended to apply the official fix by upgrading to a fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
