CVE-2016-6797: Incorrect Authorization in Apache Tomcat
Summary
CVE-2016-6797: Incorrect Authorization in Apache Tomcat. Affects org.apache.tomcat:tomcat across 4 version ranges.
>= 7.0.0, < 7.0.72
>= 8.0.0, < 8.0.37
>= 8.5.0, < 8.5.5
>= 9.0.0.M1, < 9.0.0.M10
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications. The vulnerability identified as CVE-2016-6797 affects Apache Tomcat versions 6.0.0 to 6.0.45, 7.0.0 to 7.0.70, 8.0.0.RC1 to 8.0.36, 8.5.0 to 8.5.4, and 9.0.0.M1 to 9.0.0.M9. This vulnerability allows a web application to access any global JNDI (Java Naming and Directory Interface) resource, regardless of whether it has been explicitly linked to the web application or not.
Vulnerability Detail
The ResourceLinkFactory implementation in Apache Tomcat did not restrict web application access to global JNDI resources to only those resources explicitly linked to the web application. This means that a web application could potentially access any global JNDI resource, even if it was not intended to have access to it. This vulnerability could be exploited by an attacker to gain unauthorized access to sensitive information or perform unauthorized actions on the affected system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.0.727.0.72 -
>= 8.0.0, < 8.0.378.0.37 -
>= 8.5.0, < 8.5.58.5.5 -
>= 9.0.0.M1, < 9.0.0.M109.0.0.M10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix provided by upgrading to the latest secure version of Apache Tomcat.
Conclusion
The vulnerability identified as CVE-2016-6797 in Apache Tomcat allows a web application to access any global JNDI resource, regardless of whether it has been explicitly linked to the web application or not. This could lead to unauthorized access to sensitive information or unauthorized actions on the affected system. To mitigate this vulnerability, it is crucial to upgrade to the latest secure version of Apache Tomcat. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications.
JNDI stands for Java Naming and Directory Interface. It is a Java API that provides naming and directory functionality to Java applications.
This vulnerability allows a web application to access any global JNDI resource, even if it was not intended to have access to it. This could lead to unauthorized access to sensitive information or unauthorized actions on the affected system.
To fix this vulnerability, it is recommended to upgrade to the latest secure version of Apache Tomcat.
There is no known workaround for this vulnerability. It is recommended to apply the fix provided by upgrading to the latest secure version of Apache Tomcat.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
