Apache · Tomcat
CVE-2016-8735
Apache Tomcat Remote Code Execution Vulnerability
Cos'è
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
CISA: Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.
Cosa fare
Apply updates per vendor instructions.
Scadenza per le agenzie federali USA: 2 giugno 2023
- Aggiunta all'elenco CISA
- 12 maggio 2023
- Pubblicato
- 6 aprile 2017
- Gravità
- Critica 9,8 CVSS 3.1
- Probabilità di attacchi nei prossimi 30 giorni (EPSS)
- 90% tra il 0,2% più alto di tutte le vulnerabilità note
- Tipo di debolezza
- CWE-284
- Più dettagli
- NVD · CVE.org · CISA
Tutte le fonti (20)
- http://www.debian.org/security/2016/dsa-3738
- http://rhn.redhat.com/errata/RHSA-2017-0457.html
- https://access.redhat.com/errata/RHSA-2017:0455
- https://access.redhat.com/errata/RHSA-2017:0456
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://svn.apache.org/viewvc?view=revision&revision=1767676
- http://tomcat.apache.org/security-9.html
- http://www.securitytracker.com/id/1037331
- http://www.securityfocus.com/bid/94463
- http://tomcat.apache.org/security-7.html
- http://svn.apache.org/viewvc?view=revision&revision=1767644
- http://tomcat.apache.org/security-8.html
- http://svn.apache.org/viewvc?view=revision&revision=1767656
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- https://security.netapp.com/advisory/ntap-20180607-0001/
- http://tomcat.apache.org/security-6.html
- http://svn.apache.org/viewvc?view=revision&revision=1767684
- http://seclists.org/oss-sec/2016/q4/502
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat…
Altre falle sfruttate di Apache
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 4 ago 2026 | Missing Encryption of Sensitive Data | Tomcat | Alta 7,5 | 99% |
| 1 apr 2025 | Path Equivalence | Tomcat | Critica 10,0 | 99,9% |
| 25 mar 2022 | on Windows Remote Code Execution | Tomcat | Alta 8,1 | 99,7% |
| 25 mar 2022 | Remote Code Execution | Tomcat | Alta 8,1 | >99,9% |
| 3 mar 2022 | Improper Privilege Management | Tomcat | Critica 9,8 | 99,3% |
| 8 ott 2026 | Command Injection | Struts | Alta 8,1 | 97% |
| 16 apr 2026 | Improper Input Validation | ActiveMQ | Alta 8,8 | 98% |
| 1 mag 2025 | Improper Escaping of Output | HTTP Server | Critica 9,1 | >99,9% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.