CVE-2016-0714 | BDVDB-2026-74572 Detail
Description#
The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- https://security.gentoo.org/glsa/201705-09
- http://svn.apache.org/viewvc?view=revision&revision=1726196
- http://seclists.org/bugtraq/2016/Feb/145
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html
- http://tomcat.apache.org/security-9.html
- http://www.ubuntu.com/usn/USN-3024-1
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html
- http://rhn.redhat.com/errata/RHSA-2016-2045.html
- http://svn.apache.org/viewvc?view=revision&revision=1725263
- http://www.debian.org/security/2016/dsa-3530
- http://svn.apache.org/viewvc?view=revision&revision=1726923
- http://svn.apache.org/viewvc?view=revision&revision=1727166
Show all 40
- http://svn.apache.org/viewvc?view=revision&revision=1727034
- http://tomcat.apache.org/security-7.html
- http://svn.apache.org/viewvc?view=revision&revision=1725914
- http://marc.info/?l=bugtraq&m=145974991225029&w=2
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://www.securitytracker.com/id/1037640
- http://rhn.redhat.com/errata/RHSA-2016-1089.html
- http://tomcat.apache.org/security-8.html
- https://access.redhat.com/errata/RHSA-2016:1087
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.securitytracker.com/id/1035069
- https://bto.bluecoat.com/security-advisory/sa118
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442
- http://rhn.redhat.com/errata/RHSA-2016-2807.html
- https://access.redhat.com/errata/RHSA-2016:1088
- https://security.netapp.com/advisory/ntap-20180531-0001/
- http://tomcat.apache.org/security-6.html
- http://rhn.redhat.com/errata/RHSA-2016-2808.html
- http://svn.apache.org/viewvc?view=revision&revision=1726203
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html
- http://svn.apache.org/viewvc?view=revision&revision=1727182
- http://www.securityfocus.com/bid/83327
- http://rhn.redhat.com/errata/RHSA-2016-2599.html
- http://www.debian.org/security/2016/dsa-3609
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.