Published: 25/02/2016 Updated: 08/12/2023

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 6.3 | Impact Score: 3.4 | Exploitability Score: 2.8

VMScore: 578

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x prior to 7.0.68, 8.x prior to 8.0.31, and 9.x prior to 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.

Vulnerable Product	Search on Vulmon	Subscribe to Product
debian debian linux 8.0
debian debian linux 7.0
apache tomcat 7.0.2
apache tomcat 8.0.30
apache tomcat 7.0.12
apache tomcat 7.0.62
apache tomcat 8.0.17
apache tomcat 7.0.53
apache tomcat 7.0.20
apache tomcat 7.0.34
apache tomcat 8.0.26
apache tomcat 7.0.55
apache tomcat 7.0.4
apache tomcat 7.0.63
apache tomcat 8.0.20
apache tomcat 7.0.22
apache tomcat 7.0.39
apache tomcat 7.0.26
apache tomcat 7.0.28
apache tomcat 8.0.1
apache tomcat 8.0.0
apache tomcat 7.0.59
apache tomcat 7.0.65
apache tomcat 7.0.50
apache tomcat 7.0.6
apache tomcat 8.0.12
apache tomcat 7.0.14
apache tomcat 8.0.27
apache tomcat 8.0.15
apache tomcat 7.0.11
apache tomcat 7.0.67
apache tomcat 7.0.23
apache tomcat 7.0.0
apache tomcat 8.0.22
apache tomcat 8.0.29
apache tomcat 7.0.52
apache tomcat 7.0.42
apache tomcat 7.0.37
apache tomcat 7.0.29
apache tomcat 8.0.11
apache tomcat 8.0.24
apache tomcat 8.0.23
apache tomcat 7.0.47
apache tomcat 7.0.5
apache tomcat 8.0.21
apache tomcat 7.0.41
apache tomcat 7.0.30
apache tomcat 7.0.19
apache tomcat 7.0.16
apache tomcat 7.0.10
apache tomcat 8.0.18
apache tomcat 7.0.25
apache tomcat 7.0.54
apache tomcat 7.0.35
apache tomcat 7.0.61
apache tomcat 8.0.3
apache tomcat 7.0.57
apache tomcat 8.0.14
apache tomcat 7.0.32
apache tomcat 7.0.21
apache tomcat 7.0.27
apache tomcat 7.0.40
apache tomcat 7.0.56
apache tomcat 8.0.28
apache tomcat 7.0.64
apache tomcat 7.0.33
apache tomcat 9.0.0
canonical ubuntu linux 12.04
canonical ubuntu linux 16.04
canonical ubuntu linux 15.10
canonical ubuntu linux 14.04

Several security issues were fixed in Tomcat ...

Synopsis Important: Red Hat JBoss Web Server 212 security update for Tomcat 7 Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Web ServerRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring Sys ...

Synopsis Important: Red Hat JBoss Web Server 212 security update for Tomcat 7 Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Enterprise Web Server 2 for RHEL 6 and Red Hat JBoss Enterprise Web Server 2 for RHEL 7Red Hat Product Security has rated this update ...

Multiple security vulnerabilities have been discovered in the Tomcat servlet and JSP engine, which may result in information disclosure, the bypass of CSRF protections, bypass of the SecurityManager or denial of service For the stable distribution (jessie), these problems have been fixed in version 8014-1+deb8u2 For the unstable distribution (s ...

Multiple security vulnerabilities have been discovered in the Tomcat servlet and JSP engine, which may result in information disclosure, the bypass of CSRF protections and bypass of the SecurityManager For the oldstable distribution (wheezy), these problems have been fixed in version 7028-4+deb7u4 This update also fixes CVE-2014-0119 and CVE-20 ...

ResourceLinkFactorysetGlobalContext() is a public method and was discovered to be accessible by web applications running under a security manager without any checks This allowed a malicious web application to inject a malicious global context that could in turn be used to disrupt other web applications and/or read and write data owned by other we ...

A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service ...

CWE-264 http://svn.apache.org/viewvc?view=revision&revision=1725931 http://svn.apache.org/viewvc?view=revision&revision=1725929 http://tomcat.apache.org/security-8.html http://tomcat.apache.org/security-9.html http://tomcat.apache.org/security-7.html http://seclists.org/bugtraq/2016/Feb/147 http://svn.apache.org/viewvc?view=revision&revision=1725926 http://www.debian.org/security/2016/dsa-3530 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442 http://www.debian.org/security/2016/dsa-3609 http://www.ubuntu.com/usn/USN-3024-1 http://www.debian.org/security/2016/dsa-3552 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755 http://www.securityfocus.com/bid/83326 https://access.redhat.com/errata/RHSA-2016:1087 http://rhn.redhat.com/errata/RHSA-2016-1089.html https://access.redhat.com/errata/RHSA-2016:1088 http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179356.html https://bto.bluecoat.com/security-advisory/sa118 http://www.securitytracker.com/id/1035069 https://security.gentoo.org/glsa/201705-09 http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://rhn.redhat.com/errata/RHSA-2016-2808.html http://rhn.redhat.com/errata/RHSA-2016-2807.html http://rhn.redhat.com/errata/RHSA-2016-2599.html https://security.netapp.com/advisory/ntap-20180531-0001/https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E https://usn.ubuntu.com/3024-1/https://nvd.nist.gov

CVE-2016-0763

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect