CVE-2016-0714 in the critical feed json
Improper Access Control in Apache Tomcat
published 2016-02-25 10 y ago modified 2026-10-15 25 d ago also GHSA-mv42-px54-87jw , EUVD-2022-4624
- cvss
- 8.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 13.1%
- EPSS 13.1% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.
Patch / fix
- maven org.apache.tomcat:tomcat 6.0.46, 7.0.70, 8.0.32, 9.0.0.M2
- tomcat6 Ubuntu 14.04 LTS 6.0.39-1ubuntu0.1
- tomcat6 Ubuntu 16.04 LTS 6.0.45+dfsg-1
- tomcat7 Ubuntu 14.04 LTS 7.0.52-1ubuntu0.6
ubuntu advisories UBUNTU-CVE-2016-0714
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- tomcat RHEL 7 7.0.69-10.el7
- tomcat-lib RHEL 7 7.0.69-10.el7
- tomcat-jsvc RHEL 7 7.0.69-10.el7
- tomcat-javadoc RHEL 7 7.0.69-10.el7
- tomcat-webapps RHEL 7 7.0.69-10.el7
- tomcat-el-2.2-api RHEL 7 7.0.69-10.el7
- tomcat-docs-webapp RHEL 7 7.0.69-10.el7
- tomcat-jsp-2.2-api RHEL 7 7.0.69-10.el7
red hat advisories RHSA-2016:2599RHSA-2016:2807RHSA-2016:2045RHSA-2016:1088RHSA-2016:1087
- tomcat6 SLES for SAP 11 SP4, SLES 11 SP4 6.0.45-0.50.1
- tomcat SLES for SAP 12, SLES 12 7.0.68-7.6.1
- tomcat SLES for SAP 12 SP1, SLES 12 SP1 8.0.32-3.1
suse advisories SUSE-SU-2016:0839-1SUSE-SU-2016:0822-1SUSE-SU-2016:0769-1
- tomcat openSUSE Tumbleweed 8.0.36-3.3
- tomcat10 openSUSE Tumbleweed 10.1.14-1.1
opensuse advisories openSUSE-SU-2024:10446-1openSUSE-SU-2024:13441-1
- github.com/apache/tomcat@50f1b1d commit
- github.com/apache/tomcat@79e8ad0 commit
- github.com/apache/tomcat@824eb1d commit
- github.com/apache/tomcat@e1b1002 commit
- github.com/apache/tomcat@f626da7 commit
- github.com/apache/tomcat@ff1b659 commit
- github.com/apache/tomcat80@2e5cc28 commit
- github.com/apache/tomcat80@5430f30 commit
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2016-0714 updated cvss 8.8
tomcat: Security Manager bypass via persistence mechanisms
-
Red Hat JBoss BRMS 5 jbossweb jbosswebaffected: no fix planned “Will not fix”
-
Red Hat JBoss Data Grid 6 jbossweb jbosswebaffected: no fix available
-
Red Hat JBoss Enterprise Application Platform 4 jbossweb jbossweb Red Hat JBoss Enterprise Application Platform 5 jbossweb jbossweb Red Hat JBoss Enterprise Application Platform 6 jbossweb jbossweb Red Hat JBoss Fuse Service Works 6 jbossweb jbosswebaffected: no fix planned “Will not fix”
-
Red Hat JBoss Operations Network 3 jbossweb jbossweb Red Hat JBoss Portal 6 jbossweb jbosswebaffected: no fix available
-
Red Hat Enterprise Linux Client (v. 7) tomcat 7.0.69-10.el7, tomcat-lib 7.0.69-10.el7, tomcat-jsvc 7.0.69-10.el7, tomcat-javadoc 7.0.69-10.el7, tomcat-webapps 7.0.69-10.el7, tomcat-el-2.2-api 7.0.69-10.el7, +4 more Red Hat Enterprise Linux Client Optional (v. 7) tomcat 7.0.69-10.el7, tomcat-lib 7.0.69-10.el7, tomcat-jsvc 7.0.69-10.el7, tomcat-javadoc 7.0.69-10.el7, tomcat-webapps 7.0.69-10.el7, tomcat-el-2.2-api 7.0.69-10.el7, +4 more Red Hat Enterprise Linux ComputeNode (v. 7) tomcat 7.0.69-10.el7, tomcat-lib 7.0.69-10.el7, tomcat-jsvc 7.0.69-10.el7, tomcat-javadoc 7.0.69-10.el7, tomcat-webapps 7.0.69-10.el7, tomcat-el-2.2-api 7.0.69-10.el7, +4 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat 7.0.69-10.el7, tomcat-lib 7.0.69-10.el7, tomcat-jsvc 7.0.69-10.el7, tomcat-javadoc 7.0.69-10.el7, tomcat-webapps 7.0.69-10.el7, tomcat-el-2.2-api 7.0.69-10.el7, +4 morefixed: vendor fix RHSA-2016:2599
-
Red Hat Enterprise Linux Desktop (v. 6) tomcat6 6.0.24-98.el6_8, tomcat6-lib 6.0.24-98.el6_8, tomcat6-javadoc 6.0.24-98.el6_8, tomcat6-webapps 6.0.24-98.el6_8, tomcat6-el-2.1-api 6.0.24-98.el6_8, tomcat6-docs-webapp 6.0.24-98.el6_8, +3 more Red Hat Enterprise Linux HPC Node (v. 6) tomcat6 6.0.24-98.el6_8, tomcat6-lib 6.0.24-98.el6_8, tomcat6-javadoc 6.0.24-98.el6_8, tomcat6-webapps 6.0.24-98.el6_8, tomcat6-el-2.1-api 6.0.24-98.el6_8, tomcat6-docs-webapp 6.0.24-98.el6_8, +3 more Red Hat Enterprise Linux Server (v. 6) tomcat6 6.0.24-98.el6_8, tomcat6-lib 6.0.24-98.el6_8, tomcat6-javadoc 6.0.24-98.el6_8, tomcat6-webapps 6.0.24-98.el6_8, tomcat6-el-2.1-api 6.0.24-98.el6_8, tomcat6-docs-webapp 6.0.24-98.el6_8, +3 morefixed: vendor fix RHSA-2016:2045
-
Red Hat Enterprise Linux Server (v. 7) tomcat 7.0.69-10.el7, tomcat-lib 7.0.69-10.el7, tomcat-jsvc 7.0.69-10.el7, tomcat-javadoc 7.0.69-10.el7, tomcat-webapps 7.0.69-10.el7, tomcat-el-2.2-api 7.0.69-10.el7, +4 more Red Hat Enterprise Linux Server Optional (v. 7) tomcat 7.0.69-10.el7, tomcat-lib 7.0.69-10.el7, tomcat-jsvc 7.0.69-10.el7, tomcat-javadoc 7.0.69-10.el7, tomcat-webapps 7.0.69-10.el7, tomcat-el-2.2-api 7.0.69-10.el7, +4 morefixed: vendor fix RHSA-2016:2599
-
Red Hat Enterprise Linux Workstation (v. 6) tomcat6 6.0.24-98.el6_8, tomcat6-lib 6.0.24-98.el6_8, tomcat6-javadoc 6.0.24-98.el6_8, tomcat6-webapps 6.0.24-98.el6_8, tomcat6-el-2.1-api 6.0.24-98.el6_8, tomcat6-docs-webapp 6.0.24-98.el6_8, +3 morefixed: vendor fix RHSA-2016:2045
show 6 moreshow fewer
-
Red Hat Enterprise Linux Workstation (v. 7) tomcat 7.0.69-10.el7, tomcat-lib 7.0.69-10.el7, tomcat-jsvc 7.0.69-10.el7, tomcat-javadoc 7.0.69-10.el7, tomcat-webapps 7.0.69-10.el7, tomcat-el-2.2-api 7.0.69-10.el7, +4 more Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat 7.0.69-10.el7, tomcat-lib 7.0.69-10.el7, tomcat-jsvc 7.0.69-10.el7, tomcat-javadoc 7.0.69-10.el7, tomcat-webapps 7.0.69-10.el7, tomcat-el-2.2-api 7.0.69-10.el7, +4 morefixed: vendor fix RHSA-2016:2599
-
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server tomcat7 7.0.54-23_patch_05.ep6.el6, tomcat7-lib 7.0.54-23_patch_05.ep6.el6, tomcat7-log4j 7.0.54-23_patch_05.ep6.el6, tomcat7-javadoc 7.0.54-23_patch_05.ep6.el6, tomcat7-webapps 7.0.54-23_patch_05.ep6.el6, tomcat7-el-2.2-api 7.0.54-23_patch_05.ep6.el6, +4 more Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server tomcat7 7.0.54-23_patch_05.ep6.el7, tomcat7-lib 7.0.54-23_patch_05.ep6.el7, tomcat7-log4j 7.0.54-23_patch_05.ep6.el7, tomcat7-javadoc 7.0.54-23_patch_05.ep6.el7, tomcat7-webapps 7.0.54-23_patch_05.ep6.el7, tomcat7-el-2.2-api 7.0.54-23_patch_05.ep6.el7, +4 morefixed: vendor fix RHSA-2016:2807
-
Red Hat JBoss Web Server 2.1fixed: vendor fix RHSA-2016:2808
-
Red Hat JBoss Web Server 3.0fixed: vendor fix RHSA-2016:1089
-
Red Hat JBoss Web Server 3.0 for RHEL 6 httpd24 2.4.6-61.ep7.el6, mod_ssl24 2.4.6-61.ep7.el6, mod_ldap24 2.4.6-61.ep7.el6, httpd24-tools 2.4.6-61.ep7.el6, mod_session24 2.4.6-61.ep7.el6, httpd24-manual 2.4.6-61.ep7.el6, +22 morefixed: vendor fix RHSA-2016:1087
-
Red Hat JBoss Web Server 3.0 for RHEL 7 httpd24 2.4.6-61.ep7.el7, mod_ssl24 2.4.6-61.ep7.el7, mod_ldap24 2.4.6-61.ep7.el7, httpd24-tools 2.4.6-61.ep7.el7, mod_session24 2.4.6-61.ep7.el7, httpd24-manual 2.4.6-61.ep7.el7, +22 morefixed: vendor fix RHSA-2016:1088
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 25 d ago
Exploit prediction
13.08% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| GitHub | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.tomcat:tomcat | >=9.0.0.M1, <9.0.0.M2 >=8.0.0.RC1, <8.0.32 >=7.0.0, <7.0.70 >=6.0.0, <6.0.46 |
9.0.0.M2 8.0.32 7.0.70 6.0.46 |
Classification
References
-
github.com
/apache/tomcat/commit/50f1b1da794cd93b70ab5456d3c2c984408e1506
web
-
github.com
/apache/tomcat/commit/79e8ad03404c131009811855f9a30d8d01c0c736
web
-
github.com
/apache/tomcat/commit/824eb1d1ad922e7652ecf51adb2b9eebb5bb88b5
web
-
github.com
/apache/tomcat/commit/e1b1002129fea4033329f6f619ba219527bbbd40
web
-
github.com
/apache/tomcat/commit/f626da75fd59da82b14dee7b8cc46ad51eefdbe5
web
-
github.com
/apache/tomcat/commit/ff1b659dc366a2ad47cd8f7e3544c796a1b15e46
web
-
github.com
/apache/tomcat80/commit/2e5cc28052e84ba45196949ba602484221bbf33c
web
-
github.com
/apache/tomcat80/commit/5430f30c79383e4d2d87785468905fcb00bace58
web
-
security.gentoo.org
/glsa/201705-09
vendor-advisory, web
-
lists.opensuse.org
/opensuse-security-announce/2016-03/msg00085.html
vendor-advisory, web
-
ubuntu.com
/usn/USN-3024-1
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-03/msg00047.html
vendor-advisory, web
-
rhn.redhat.com
/errata/RHSA-2016-2045.html
vendor-advisory
-
debian.org
/security/2016/dsa-3530
vendor-advisory
-
marc.info
/?l=bugtraq&m=145974991225029&w=2
vendor-advisory, web
-
rhn.redhat.com
/errata/RHSA-2016-1089.html
vendor-advisory
-
access.redhat.com
/errata/RHSA-2016:1087
vendor-advisory, web
-
rhn.redhat.com
/errata/RHSA-2016-2807.html
vendor-advisory
-
access.redhat.com
/errata/RHSA-2016:1088
vendor-advisory, web
-
rhn.redhat.com
/errata/RHSA-2016-2808.html
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-03/msg00069.html
vendor-advisory, web
-
rhn.redhat.com
/errata/RHSA-2016-2599.html
vendor-advisory
-
debian.org
/security/2016/dsa-3609
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-03/msg00082.html
vendor-advisory, web
-
debian.org
/security/2016/dsa-3552
vendor-advisory
-
tomcat.apache.org
/security-9.html
vendor-advisory
-
tomcat.apache.org
/security-7.html
vendor-advisory
-
tomcat.apache.org
/security-8.html
vendor-advisory
-
tomcat.apache.org
/security-6.html
vendor-advisory
-
h20566.www2.hpe.com
/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964
web
- oracle.com /technetwork/security-advisory/cpujul2018-4258247.html
- svn.apache.org /viewvc?view=revision&revision=1726196
-
seclists.org
/bugtraq/2016/Feb/145
mailing-list
- oracle.com /technetwork/topics/security/linuxbulletinoct2016-3090545.html
- svn.apache.org /viewvc?view=revision&revision=1725263
- svn.apache.org /viewvc?view=revision&revision=1726923
- svn.apache.org /viewvc?view=revision&revision=1727166
- svn.apache.org /viewvc?view=revision&revision=1727034
- svn.apache.org /viewvc?view=revision&revision=1725914
- oracle.com /technetwork/security-advisory/cpuoct2016-2881722.html
-
securitytracker.com
/id/1037640
vdb-entry
- oracle.com /technetwork/topics/security/bulletinapr2016-2952098.html
- oracle.com /technetwork/security-advisory/cpuoct2017-3236626.html
-
securitytracker.com
/id/1035069
vdb-entry
-
bto.bluecoat.com
/security-advisory/sa118
web
-
h20566.www2.hpe.com
/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442
web
- security.netapp.com /advisory/ntap-20180531-0001/
- svn.apache.org /viewvc?view=revision&revision=1726203
-
nvd.nist.gov
/vuln/detail/CVE-2016-0714
advisory
-
lists.apache.org
/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
web
-
lists.apache.org
/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
web
-
security.netapp.com
/advisory/ntap-20180531-0001
web
-
web.archive.org
/web/20170204045529/http://www.securityfocus.com/bid/83327
web
-
web.archive.org
/web/20170601064840/http://www.securitytracker.com/id/1035069
web
Sources
- CVE List CVE-2016-0714
- GitHub Advisory GHSA-mv42-px54-87jw
- NVD CVE-2016-0714
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.