Back

HIGH

tomcat: security manager bypass via JSP Servlet config parameters

Published Aug 11, 2017

Description

A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (0)

No CWE recorded.

References (61)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner apache
Published Aug 11, 2017
Updated Sep 17, 2024
Reserved Aug 12, 2016
NVD
Status Modified
Modified Jun 17, 2026
Red Hat
Severity Low
Public date Oct 27, 2016
GHSA-3MJP-P938-4329