CVE-2016-0706

תיאור (מקור, אנגלית)

Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.

מדדים

EPSS — סבירות ניצול

6% (אחוזון 100) נכון ל-18/10/2026

CWE

CWE-200

מוצרים מושפעים

canonical: ubuntu linux; debian: debian linux; apache: tomcat

קישורים

• http://tomcat.apache.org/security-6.html Vendor Advisory
• http://tomcat.apache.org/security-7.html Vendor Advisory
• http://tomcat.apache.org/security-8.html Vendor Advisory
• http://tomcat.apache.org/security-9.html Vendor Advisory
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na‮… Vendor Advisory
• http://tomcat.apache.org/security-6.html Vendor Advisory
• http://tomcat.apache.org/security-7.html Vendor Advisory
• http://tomcat.apache.org/security-8.html Vendor Advisory
• http://tomcat.apache.org/security-9.html Vendor Advisory
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na‮… Vendor Advisory