QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2016-5018

Back to search

CVE-2016-5018

Published: Aug 10, 2017

Modified: Sep 16, 2024

PUBLISHED

Description

In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.

VendorProductVersions

Apache Software Foundation

Apache Tomcat

affected
9.0.0.M1 to 9.0.0.M9
affected
8.5.0 to 8.5.4
affected
8.0.0.RC1 to 8.0.36
affected
7.0.0 to 7.0.70
affected
6.0.0 to 6.0.45

References

RHSA-2017:1548
vendor-advisory
x_refsource_REDHAT
RHSA-2017:1549
vendor-advisory
x_refsource_REDHAT
93942
vdb-entry
x_refsource_BID
RHSA-2017:1552
vendor-advisory
x_refsource_REDHAT
1038757
vdb-entry
x_refsource_SECTRACK
RHSA-2017:2247
vendor-advisory
x_refsource_REDHAT
RHSA-2017:1551
vendor-advisory
x_refsource_REDHAT
1037142
vdb-entry
x_refsource_SECTRACK
RHSA-2017:0457
vendor-advisory
x_refsource_REDHAT
RHSA-2017:0455
vendor-advisory
x_refsource_REDHAT
RHSA-2017:1550
vendor-advisory
x_refsource_REDHAT
DSA-3720
vendor-advisory
x_refsource_DEBIAN
RHSA-2017:0456
vendor-advisory
x_refsource_REDHAT
USN-4557-1
vendor-advisory
x_refsource_UBUNTU

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now