QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2016-6797

Back to search

CVE-2016-6797

Published: Aug 10, 2017

Modified: Sep 17, 2024

PUBLISHED

Description

The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.

VendorProductVersions

Apache Software Foundation

Apache Tomcat

affected
9.0.0.M1 to 9.0.0.M9
affected
8.5.0 to 8.5.4
affected
8.0.0.RC1 to 8.0.36
affected
7.0.0 to 7.0.70
affected
6.0.0 to 6.0.45

References

93940
vdb-entry
x_refsource_BID
1037145
vdb-entry
x_refsource_SECTRACK
RHSA-2017:2247
vendor-advisory
x_refsource_REDHAT
RHSA-2017:0457
vendor-advisory
x_refsource_REDHAT
RHSA-2017:0455
vendor-advisory
x_refsource_REDHAT
DSA-3720
vendor-advisory
x_refsource_DEBIAN
RHSA-2017:0456
vendor-advisory
x_refsource_REDHAT
USN-4557-1
vendor-advisory
x_refsource_UBUNTU

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now