CVE-2016-6796 (High) detected in tomcat-catalina-7.0.42.jar - autoclosed

[mend-for-github-com]

CVE-2016-6796 - High Severity Vulnerability

Vulnerable Library - tomcat-catalina-7.0.42.jar

Tomcat Servlet Engine Core Classes and Standard implementations

Library home page: http://tomcat.apache.org/

Dependency Hierarchy:

• ❌ tomcat-catalina-7.0.42.jar (Vulnerable Library)

Found in HEAD commit: 910335bf446a1a65011c17bf5badb72c4d4efc50

Vulnerability Details

A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.

Publish Date: 2017-08-11

URL: CVE-2016-6796

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6796

Release Date: 2017-08-11

Fix Resolution: org.apache.tomcat.embed:tomcat-embed-jasper:9.0.0.M10,8.5.5,8.0.37,7.0.72,org.apache.tomcat:tomcat-catalina:9.0.0.M10,8.5.5,8.0.37,7.0.72,org.apache.tomcat:tomcat-jasper:9.0.0.M10,8.5.5,8.0.37,7.0.72,org.apache.tomcat:catalina:6.0.47,org.apache.tomcat:jasper:6.0.47

[mend-for-github-com]

ℹ️ This issue was automatically closed by WhiteSource because it is a duplicate of an existing issue: #91