CVE-2016-0714: Improper Access Control in Apache Tomcat
Summary
CVE-2016-0714: Improper Access Control in Apache Tomcat. Affects org.apache.tomcat:tomcat across 4 version ranges.
>= 6.0.0, < 6.0.46
>= 7.0.0, < 7.0.70
>= 8.0.0.RC1, < 8.0.32
>= 9.0.0.M1, < 9.0.0.M2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications. The vulnerability identified as CVE-2016-0714 affects versions 6.x, 7.x, 8.x, and 9.x of Apache Tomcat. This vulnerability allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context. It occurs due to mishandling of session attributes in the session-persistence implementation of Apache Tomcat.
Vulnerability Detail
The vulnerability arises when a web application places a crafted object in a session. This allows remote authenticated users to bypass the intended SecurityManager restrictions and execute arbitrary code with elevated privileges. The session-persistence implementation in Apache Tomcat versions 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 is affected by this vulnerability. The impact of this vulnerability is significant as it enables attackers to execute arbitrary code, potentially leading to unauthorized access, data breaches, and system compromise.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 6.0.0, < 6.0.466.0.46 -
>= 7.0.0, < 7.0.707.0.70 -
>= 8.0.0.RC1, < 8.0.328.0.32 -
>= 9.0.0.M1, < 9.0.0.M29.0.0.M2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can disable session persistence or restrict access to the affected web applications. Disabling session persistence prevents the vulnerability from being exploited. Restricting access to the affected web applications reduces the risk of unauthorized access. However, these workarounds may impact the functionality and user experience of the web applications, so upgrading to the fixed versions is the recommended solution.
Conclusion
The vulnerability identified as CVE-2016-0714 in Apache Tomcat poses a significant risk to the security of web applications. It allows remote authenticated users to execute arbitrary code with elevated privileges, potentially leading to unauthorized access, data breaches, and system compromise. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of Apache Tomcat. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container used for hosting Java-based web applications.
The vulnerability allows remote authenticated users to execute arbitrary code with elevated privileges, potentially leading to unauthorized access, data breaches, and system compromise.
Versions 6.x, 7.x, 8.x, and 9.x of Apache Tomcat are affected.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Apache Tomcat.
Yes, users can disable session persistence or restrict access to the affected web applications as temporary workarounds.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
