CVE-2016-0706 (Medium) detected in tomcat-catalina-7.0.42.jar, tomcat-embed-core-8.0.18.jar

[mend-for-github-com]

CVE-2016-0706 - Medium Severity Vulnerability

Vulnerable Libraries - tomcat-catalina-7.0.42.jar, tomcat-embed-core-8.0.18.jar

tomcat-catalina-7.0.42.jar

Tomcat Servlet Engine Core Classes and Standard implementations

Library home page: http://tomcat.apache.org/

Path to dependency file: /pom.xml

Path to vulnerable library: /repository/org/apache/tomcat/tomcat-catalina/7.0.42/tomcat-catalina-7.0.42.jar

Dependency Hierarchy:

• ❌ tomcat-catalina-7.0.42.jar (Vulnerable Library)

tomcat-embed-core-8.0.18.jar

Core Tomcat implementation

Library home page: http://tomcat.apache.org/

Path to dependency file: /pom.xml

Path to vulnerable library: /repository/org/apache/tomcat/embed/tomcat-embed-core/8.0.18/tomcat-embed-core-8.0.18.jar

Dependency Hierarchy:

• ❌ tomcat-embed-core-8.0.18.jar (Vulnerable Library)

Found in HEAD commit: 910335bf446a1a65011c17bf5badb72c4d4efc50

Found in base branches: dev, master

Vulnerability Details

Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.

Publish Date: 2016-02-25

URL: CVE-2016-0706

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0706

Release Date: 2016-02-25

Fix Resolution: 8.0.32

---

⛑️ Automatic Remediation is available for this issue