QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2014-7810

Back to search

CVE-2014-7810

Published: Jun 7, 2015

Modified: Aug 6, 2024

PUBLISHED

Description

The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.

VendorProductVersions

n/a

n/a

affected
n/a

References

RHSA-2016:0492
vendor-advisory
x_refsource_REDHAT
USN-2654-1
vendor-advisory
x_refsource_UBUNTU
RHSA-2015:1622
vendor-advisory
x_refsource_REDHAT
DSA-3530
vendor-advisory
x_refsource_DEBIAN
HPSBUX03561
vendor-advisory
x_refsource_HP
RHSA-2016:2046
vendor-advisory
x_refsource_REDHAT
DSA-3428
vendor-advisory
x_refsource_DEBIAN
74665
vdb-entry
x_refsource_BID
1032330
vdb-entry
x_refsource_SECTRACK
USN-2655-1
vendor-advisory
x_refsource_UBUNTU
RHSA-2015:1621
vendor-advisory
x_refsource_REDHAT
DSA-3447
vendor-advisory
x_refsource_DEBIAN

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now