Skip to content
Fencer Intel
high 7.5

CVE-2016-6796 json

Apache Tomcat vulnerable to SecurityManager bypass

published 2017-08-11 9 y ago modified 2026-10-08 31 d ago also GHSA-3mjp-p938-4329 , EUVD-2022-2211

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
8.3%
EPSS 8.3% chance of exploitation in 30 days, percentile 94%
public exploits
0
none known

Summary

A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.

Patch / fix

  • maven org.apache.tomcat:tomcat 6.0.46, 7.0.71, 8.0.37, 8.5.5, 9.0.0.M10
  • tomcat6 Ubuntu 16.04 LTS 6.0.45+dfsg-1ubuntu0.1
  • tomcat7 Ubuntu 14.04 LTS 7.0.52-1ubuntu0.8
  • tomcat7 Ubuntu 16.04 LTS 7.0.68-1ubuntu0.3
  • tomcat8 Ubuntu 16.04 LTS 8.0.32-1ubuntu1.3

ubuntu advisories UBUNTU-CVE-2016-6796

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • tomcat RHEL 7 7.0.76-2.el7
  • tomcat-lib RHEL 7 7.0.76-2.el7
  • tomcat-jsvc RHEL 7 7.0.76-2.el7
  • tomcat-javadoc RHEL 7 7.0.76-2.el7
  • tomcat-webapps RHEL 7 7.0.76-2.el7
  • tomcat-el-2.2-api RHEL 7 7.0.76-2.el7
  • tomcat-docs-webapp RHEL 7 7.0.76-2.el7
  • tomcat-jsp-2.2-api RHEL 7 7.0.76-2.el7

red hat advisories RHSA-2017:2247RHSA-2017:1552RHSA-2017:1548RHSA-2017:1549RHSA-2017:1550RHSA-2017:0456

  • tomcat6 SLES for SAP 11 SP4, SLES 11 SP4, SLES 11 SP3-TERADATA +2 more 6.0.53-0.56.1
  • tomcat SLES for SAP 12 SP1, SLES 12 SP1 8.0.32-10.13.2
  • tomcat SLES for SAP 12 SP2, SLES for Raspberry Pi 12 SP2, SLES 12 SP2 8.0.36-17.1
  • tomcat SLES for SAP 12, SLES 12-LTSS 7.0.78-7.13.4

suse advisories SUSE-SU-2017:1660-1SUSE-SU-2017:1632-1SUSE-SU-2016:3079-1SUSE-SU-2016:3081-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-6796 updated cvss 4.2

tomcat: security manager bypass via JSP Servlet config parameters

  • Red Hat Enterprise Linux 5 tomcat5 Red Hat Enterprise Linux 6 tomcat6, tomcat6-lib, tomcat6-log4j, tomcat6-javadoc, tomcat6-webapps, tomcat6-el-2.1-api, +4 more
    affected: no fix planned “Will not fix”
  • Red Hat JBoss BRMS 5 jbossweb jbossweb Red Hat JBoss Data Grid 6 jbossweb jbossweb Red Hat JBoss Data Virtualization 6 jbossweb jbossweb Red Hat JBoss Enterprise Application Platform 5 jbossweb jbossweb
    affected: no fix planned “Out of support scope”
  • Red Hat JBoss Enterprise Web Server 2 tomcat6, tomcat6-lib, tomcat6-log4j, tomcat6-javadoc, tomcat6-webapps, tomcat7 tomcat7, +6 more
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Web Server 3 tomcat7 tomcat7, tomcat8 tomcat8
    affected: no fix available “Fix deferred”
  • Red Hat JBoss Fuse Service Works 6 jbossweb jbossweb
    affected: no fix available
  • Red Hat JBoss Operations Network 3 jbossweb jbossweb
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux Client (v. 7) tomcat 7.0.76-2.el7, tomcat-servlet-3.0-api 7.0.76-2.el7 Red Hat Enterprise Linux Client Optional (v. 7) tomcat 7.0.76-2.el7, tomcat-lib 7.0.76-2.el7, tomcat-jsvc 7.0.76-2.el7, tomcat-javadoc 7.0.76-2.el7, tomcat-webapps 7.0.76-2.el7, tomcat-el-2.2-api 7.0.76-2.el7, +3 more Red Hat Enterprise Linux ComputeNode (v. 7) tomcat 7.0.76-2.el7, tomcat-servlet-3.0-api 7.0.76-2.el7 Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat 7.0.76-2.el7, tomcat-lib 7.0.76-2.el7, tomcat-jsvc 7.0.76-2.el7, tomcat-javadoc 7.0.76-2.el7, tomcat-webapps 7.0.76-2.el7, tomcat-el-2.2-api 7.0.76-2.el7, +3 more Red Hat Enterprise Linux Server (v. 7) tomcat 7.0.76-2.el7, tomcat-lib 7.0.76-2.el7, tomcat-webapps 7.0.76-2.el7, tomcat-el-2.2-api 7.0.76-2.el7, tomcat-jsp-2.2-api 7.0.76-2.el7, tomcat-admin-webapps 7.0.76-2.el7, +1 more Red Hat Enterprise Linux Server Optional (v. 7) tomcat 7.0.76-2.el7, tomcat-lib 7.0.76-2.el7, tomcat-jsvc 7.0.76-2.el7, tomcat-javadoc 7.0.76-2.el7, tomcat-webapps 7.0.76-2.el7, tomcat-el-2.2-api 7.0.76-2.el7, +3 more
    +2 more products
    Red Hat Enterprise Linux Workstation (v. 7) tomcat 7.0.76-2.el7, tomcat-lib 7.0.76-2.el7, tomcat-webapps 7.0.76-2.el7, tomcat-el-2.2-api 7.0.76-2.el7, tomcat-jsp-2.2-api 7.0.76-2.el7, tomcat-admin-webapps 7.0.76-2.el7, +1 more Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-jsvc 7.0.76-2.el7, tomcat-javadoc 7.0.76-2.el7, tomcat-docs-webapp 7.0.76-2.el7
    fixed: vendor fix RHSA-2017:2247
  • Red Hat JBoss Enterprise Application Platform 6.4
    fixed: vendor fix RHSA-2017:1551
show 7 more
  • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server hornetq 2.3.25-21.SP19_redhat_1.1.ep6.el5, jgroups 3.2.17-1.Final_redhat_1.1.ep6.el5, jbossts 4.17.42-1.Final_redhat_1.1.ep6.el5, jbossweb 7.5.23-1.Final_redhat_1.1.ep6.el5, picketbox 4.1.6-1.Final_redhat_1.1.ep6.el5, resteasy 2.3.20-1.Final_redhat_1.1.ep6.el5, +78 more
    fixed: vendor fix RHSA-2017:1550
  • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server hornetq 2.3.25-21.SP19_redhat_1.1.ep6.el6, jgroups 3.2.17-1.Final_redhat_1.1.ep6.el6, jbossts 4.17.42-1.Final_redhat_1.1.ep6.el6, jbossweb 7.5.23-1.Final_redhat_1.1.ep6.el6, picketbox 4.1.6-1.Final_redhat_1.1.ep6.el6, resteasy 2.3.20-1.Final_redhat_1.1.ep6.el6, +80 more
    fixed: vendor fix RHSA-2017:1549
  • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server hornetq 2.3.25-21.SP19_redhat_1.1.ep6.el7, jgroups 3.2.17-1.Final_redhat_1.1.ep6.el7, jbossts 4.17.42-1.Final_redhat_1.1.ep6.el7, jbossweb 7.5.23-1.Final_redhat_1.1.ep6.el7, picketbox 4.1.6-1.Final_redhat_1.1.ep6.el7, resteasy 2.3.20-1.Final_redhat_1.1.ep6.el7, +78 more
    fixed: vendor fix RHSA-2017:1548
  • Red Hat JBoss Web Server 3.1
    fixed: vendor fix RHSA-2017:0457
  • Red Hat JBoss Web Server 3.1 for RHEL 6 tomcat7 7.0.70-16.ep7.el6, tomcat8 8.0.36-17.ep7.el6, tomcat7-lib 7.0.70-16.ep7.el6, tomcat8-lib 8.0.36-17.ep7.el6, tomcat7-jsvc 7.0.70-16.ep7.el6, tomcat8-jsvc 8.0.36-17.ep7.el6, +31 more
    fixed: vendor fix RHSA-2017:0455
  • Red Hat JBoss Web Server 3.1 for RHEL 7 tomcat7 7.0.70-16.ep7.el7, tomcat8 8.0.36-17.ep7.el7, tomcat7-lib 7.0.70-16.ep7.el7, tomcat8-lib 8.0.36-17.ep7.el7, tomcat7-jsvc 7.0.70-16.ep7.el7, tomcat8-jsvc 8.0.36-17.ep7.el7, +31 more
    fixed: vendor fix RHSA-2017:0456
  • Red Hat JBoss Fuse 6 jbossweb jbossweb
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
31 d ago

Exploit prediction

8.32% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.apache.tomcat:tomcat
>=9.0.0.M1, <9.0.0.M10
>=8.5.0, <8.5.5
>=8.0.0.RC1, <8.0.37
>=7.0.0, <7.0.71
>=6.0.0, <6.0.46
9.0.0.M10
8.5.5
8.0.37
7.0.71
6.0.46

Affected products

  • Apache Software Foundation Apache Tomcat

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.