CVE-2016-0706 json
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
published 2016-02-25 10 y ago modified 2026-10-15 25 d ago also GHSA-6vx3-hr43-cfrh , EUVD-2022-2864
- cvss
- 4.3
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 6.1%
- EPSS 6.1% chance of exploitation in 30 days, percentile 93%
- public exploits
- 0
- none known
Summary
Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.
Patch / fix
- maven org.apache.tomcat:tomcat 6.0.45, 8.0.31, 9.0.0.M2
- tomcat6 Ubuntu 14.04 LTS 6.0.39-1ubuntu0.1
- tomcat6 Ubuntu 16.04 LTS 6.0.45+dfsg-1
- tomcat7 Ubuntu 14.04 LTS 7.0.52-1ubuntu0.6
ubuntu advisories UBUNTU-CVE-2016-0706
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- tomcat RHEL 7 7.0.69-10.el7
- tomcat-lib RHEL 7 7.0.69-10.el7
- tomcat-jsvc RHEL 7 7.0.69-10.el7
- tomcat-javadoc RHEL 7 7.0.69-10.el7
- tomcat-webapps RHEL 7 7.0.69-10.el7
- tomcat-el-2.2-api RHEL 7 7.0.69-10.el7
- tomcat-docs-webapp RHEL 7 7.0.69-10.el7
- tomcat-jsp-2.2-api RHEL 7 7.0.69-10.el7
red hat advisories RHSA-2016:2599RHSA-2016:2807RHSA-2016:2045RHSA-2016:1088RHSA-2016:1087
- tomcat6 SLES for SAP 11 SP4, SLES 11 SP4 6.0.45-0.50.1
- tomcat SLES for SAP 12, SLES 12 7.0.68-7.6.1
- tomcat SLES for SAP 12 SP1, SLES 12 SP1 8.0.32-3.1
suse advisories SUSE-SU-2016:0839-1SUSE-SU-2016:0822-1SUSE-SU-2016:0769-1
- tomcat openSUSE Tumbleweed 8.0.36-3.3
- tomcat10 openSUSE Tumbleweed 10.1.14-1.1
opensuse advisories openSUSE-SU-2024:10446-1openSUSE-SU-2024:13441-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2016-0706 updated cvss 4.3
tomcat: security manager bypass via StatusManagerServlet
-
Red Hat JBoss BRMS 5 jbossweb jbosswebaffected: no fix planned “Will not fix”
-
Red Hat JBoss Data Grid 6 jbossweb jbosswebaffected: no fix available
-
Red Hat JBoss Fuse Service Works 6 jbossweb jbosswebaffected: no fix planned “Will not fix”
-
Red Hat JBoss Operations Network 3 jbossweb jbossweb Red Hat JBoss Portal 6 jbossweb jbosswebaffected: no fix available
-
Red Hat Enterprise Linux Client (v. 7) tomcat 7.0.69-10.el7, tomcat-lib 7.0.69-10.el7, tomcat-jsvc 7.0.69-10.el7, tomcat-javadoc 7.0.69-10.el7, tomcat-webapps 7.0.69-10.el7, tomcat-el-2.2-api 7.0.69-10.el7, +4 more Red Hat Enterprise Linux Client Optional (v. 7) tomcat 7.0.69-10.el7, tomcat-lib 7.0.69-10.el7, tomcat-jsvc 7.0.69-10.el7, tomcat-javadoc 7.0.69-10.el7, tomcat-webapps 7.0.69-10.el7, tomcat-el-2.2-api 7.0.69-10.el7, +4 more Red Hat Enterprise Linux ComputeNode (v. 7) tomcat 7.0.69-10.el7, tomcat-lib 7.0.69-10.el7, tomcat-jsvc 7.0.69-10.el7, tomcat-javadoc 7.0.69-10.el7, tomcat-webapps 7.0.69-10.el7, tomcat-el-2.2-api 7.0.69-10.el7, +4 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat 7.0.69-10.el7, tomcat-lib 7.0.69-10.el7, tomcat-jsvc 7.0.69-10.el7, tomcat-javadoc 7.0.69-10.el7, tomcat-webapps 7.0.69-10.el7, tomcat-el-2.2-api 7.0.69-10.el7, +4 morefixed: vendor fix RHSA-2016:2599
-
Red Hat Enterprise Linux Desktop (v. 6) tomcat6 6.0.24-98.el6_8, tomcat6-lib 6.0.24-98.el6_8, tomcat6-javadoc 6.0.24-98.el6_8, tomcat6-webapps 6.0.24-98.el6_8, tomcat6-el-2.1-api 6.0.24-98.el6_8, tomcat6-docs-webapp 6.0.24-98.el6_8, +3 more Red Hat Enterprise Linux HPC Node (v. 6) tomcat6 6.0.24-98.el6_8, tomcat6-lib 6.0.24-98.el6_8, tomcat6-javadoc 6.0.24-98.el6_8, tomcat6-webapps 6.0.24-98.el6_8, tomcat6-el-2.1-api 6.0.24-98.el6_8, tomcat6-docs-webapp 6.0.24-98.el6_8, +3 more Red Hat Enterprise Linux Server (v. 6) tomcat6 6.0.24-98.el6_8, tomcat6-lib 6.0.24-98.el6_8, tomcat6-javadoc 6.0.24-98.el6_8, tomcat6-webapps 6.0.24-98.el6_8, tomcat6-el-2.1-api 6.0.24-98.el6_8, tomcat6-docs-webapp 6.0.24-98.el6_8, +3 morefixed: vendor fix RHSA-2016:2045
-
Red Hat Enterprise Linux Server (v. 7) tomcat 7.0.69-10.el7, tomcat-lib 7.0.69-10.el7, tomcat-jsvc 7.0.69-10.el7, tomcat-javadoc 7.0.69-10.el7, tomcat-webapps 7.0.69-10.el7, tomcat-el-2.2-api 7.0.69-10.el7, +4 more Red Hat Enterprise Linux Server Optional (v. 7) tomcat 7.0.69-10.el7, tomcat-lib 7.0.69-10.el7, tomcat-jsvc 7.0.69-10.el7, tomcat-javadoc 7.0.69-10.el7, tomcat-webapps 7.0.69-10.el7, tomcat-el-2.2-api 7.0.69-10.el7, +4 morefixed: vendor fix RHSA-2016:2599
-
Red Hat Enterprise Linux Workstation (v. 6) tomcat6 6.0.24-98.el6_8, tomcat6-lib 6.0.24-98.el6_8, tomcat6-javadoc 6.0.24-98.el6_8, tomcat6-webapps 6.0.24-98.el6_8, tomcat6-el-2.1-api 6.0.24-98.el6_8, tomcat6-docs-webapp 6.0.24-98.el6_8, +3 morefixed: vendor fix RHSA-2016:2045
show 7 moreshow fewer
-
Red Hat Enterprise Linux Workstation (v. 7) tomcat 7.0.69-10.el7, tomcat-lib 7.0.69-10.el7, tomcat-jsvc 7.0.69-10.el7, tomcat-javadoc 7.0.69-10.el7, tomcat-webapps 7.0.69-10.el7, tomcat-el-2.2-api 7.0.69-10.el7, +4 more Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat 7.0.69-10.el7, tomcat-lib 7.0.69-10.el7, tomcat-jsvc 7.0.69-10.el7, tomcat-javadoc 7.0.69-10.el7, tomcat-webapps 7.0.69-10.el7, tomcat-el-2.2-api 7.0.69-10.el7, +4 morefixed: vendor fix RHSA-2016:2599
-
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server tomcat7 7.0.54-23_patch_05.ep6.el6, tomcat7-lib 7.0.54-23_patch_05.ep6.el6, tomcat7-log4j 7.0.54-23_patch_05.ep6.el6, tomcat7-javadoc 7.0.54-23_patch_05.ep6.el6, tomcat7-webapps 7.0.54-23_patch_05.ep6.el6, tomcat7-el-2.2-api 7.0.54-23_patch_05.ep6.el6, +4 more Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server tomcat7 7.0.54-23_patch_05.ep6.el7, tomcat7-lib 7.0.54-23_patch_05.ep6.el7, tomcat7-log4j 7.0.54-23_patch_05.ep6.el7, tomcat7-javadoc 7.0.54-23_patch_05.ep6.el7, tomcat7-webapps 7.0.54-23_patch_05.ep6.el7, tomcat7-el-2.2-api 7.0.54-23_patch_05.ep6.el7, +4 morefixed: vendor fix RHSA-2016:2807
-
Red Hat JBoss Web Server 2.1fixed: vendor fix RHSA-2016:2808
-
Red Hat JBoss Web Server 3.0fixed: vendor fix RHSA-2016:1089
-
Red Hat JBoss Web Server 3.0 for RHEL 6 httpd24 2.4.6-61.ep7.el6, mod_ssl24 2.4.6-61.ep7.el6, mod_ldap24 2.4.6-61.ep7.el6, httpd24-tools 2.4.6-61.ep7.el6, mod_session24 2.4.6-61.ep7.el6, httpd24-manual 2.4.6-61.ep7.el6, +22 morefixed: vendor fix RHSA-2016:1087
-
Red Hat JBoss Web Server 3.0 for RHEL 7 httpd24 2.4.6-61.ep7.el7, mod_ssl24 2.4.6-61.ep7.el7, mod_ldap24 2.4.6-61.ep7.el7, httpd24-tools 2.4.6-61.ep7.el7, mod_session24 2.4.6-61.ep7.el7, httpd24-manual 2.4.6-61.ep7.el7, +22 morefixed: vendor fix RHSA-2016:1088
-
Red Hat JBoss Enterprise Application Platform 4 jbossweb jbossweb Red Hat JBoss Enterprise Application Platform 5 jbossweb jbossweb Red Hat JBoss Enterprise Application Platform 6 jbossweb jbosswebnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 25 d ago
Exploit prediction
6.11% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 4.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
| GitHub | 3.0 | 4.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.tomcat:tomcat | >=9.0.0.M1, <9.0.0.M2 >=8.0.0.RC1, <8.0.31 >=6.0.0, <6.0.45 |
9.0.0.M2 8.0.31 6.0.45 |
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
security.gentoo.org
/glsa/201705-09
vendor-advisory, web
-
lists.opensuse.org
/opensuse-security-announce/2016-03/msg00085.html
vendor-advisory, web
-
ubuntu.com
/usn/USN-3024-1
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-03/msg00047.html
vendor-advisory, web
-
rhn.redhat.com
/errata/RHSA-2016-2045.html
vendor-advisory, web
-
debian.org
/security/2016/dsa-3530
vendor-advisory, mailing-list, third-party-advisory
-
marc.info
/?l=bugtraq&m=145974991225029&w=2
vendor-advisory, web, third-party-advisory
-
rhn.redhat.com
/errata/RHSA-2016-1089.html
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2016:1087
vendor-advisory, web
-
rhn.redhat.com
/errata/RHSA-2016-2807.html
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2016:1088
vendor-advisory, web
-
rhn.redhat.com
/errata/RHSA-2016-2808.html
vendor-advisory, web
-
lists.opensuse.org
/opensuse-security-announce/2016-03/msg00069.html
vendor-advisory, web
-
rhn.redhat.com
/errata/RHSA-2016-2599.html
vendor-advisory, web
-
debian.org
/security/2016/dsa-3609
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-03/msg00082.html
vendor-advisory, web
-
debian.org
/security/2016/dsa-3552
vendor-advisory, third-party-advisory
-
h20566.www2.hpe.com
/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964
web, vendor-advisory
-
tomcat.apache.org
/security-9.html
vendor-advisory
-
tomcat.apache.org
/security-7.html
vendor-advisory
-
tomcat.apache.org
/security-8.html
vendor-advisory
-
tomcat.apache.org
/security-6.html
vendor-advisory
-
svn.apache.org
/viewvc?view=revision&revision=1722800
web
- oracle.com /technetwork/security-advisory/cpujul2018-4258247.html
- oracle.com /technetwork/topics/security/linuxbulletinoct2016-3090545.html
- oracle.com /technetwork/security-advisory/cpuoct2016-2881722.html
-
svn.apache.org
/viewvc?view=revision&revision=1722802
issue-tracking
- oracle.com /technetwork/topics/security/bulletinapr2016-2952098.html
- oracle.com /technetwork/security-advisory/cpuoct2017-3236626.html
-
securitytracker.com
/id/1035069
vdb-entry
-
bto.bluecoat.com
/security-advisory/sa118
web
-
h20566.www2.hpe.com
/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442
web, third-party-advisory
- security.netapp.com /advisory/ntap-20180531-0001/
-
securityfocus.com
/bid/83324
vdb-entry
-
seclists.org
/bugtraq/2016/Feb/144
mailing-list, web
-
svn.apache.org
/viewvc?view=revision&revision=1722799
web, issue-tracking
-
h20566.www2.hpe.com
/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626
web, third-party-advisory
-
svn.apache.org
/viewvc?view=revision&revision=1722801
web, issue-tracking
-
lists.apache.org
/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E
mailing-list, web
-
lists.apache.org
/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E
mailing-list, web
-
nvd.nist.gov
/vuln/detail/CVE-2016-0706
advisory
-
web.archive.org
/web/20160321234551/http://www.securitytracker.com/id/1035069
web
-
web.archive.org
/web/20160226210040/http://www.securityfocus.com/bid/83324
web
-
security.netapp.com
/advisory/ntap-20180531-0001
web
-
lists.apache.org
/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E
web
-
github.com
/apache/tomcat
package
Sources
- CVE List CVE-2016-0706
- GitHub Advisory GHSA-6vx3-hr43-cfrh
- NVD CVE-2016-0706
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.