EXPOSURES › CVE-2016-5018
CVE-2016-5018
CRITICAL
DETAIL
SourceNVD · cve
Published2017-08-10
CVSS9.1
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2016-5018 ↗
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
PLAYERS IMPLICATED
NetApp · vendorOracle · vendorapache · vendorcanonical · vendordebian · vendorredhat · vendorTomcat · productdebian linux · productenterprise linux desktop · productenterprise linux eus · productenterprise linux server · productenterprise linux server aus · productenterprise linux server tus · productenterprise linux workstation · productjboss enterprise application platform · productjboss enterprise web server · productoncommand insight · productoncommand shift · productsnap creator framework · producttekelec platform distribution · productubuntu linux · product
DESCRIPTION
In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.
SENTIMENT · TRUSTED SOURCES
synthesis
severe-fallout
-0.60
Apache Tomcat allowed a malicious web app to bypass SecurityManager via an accessible utility method, spanning multiple major versions and requiring urgent patching.
Apache Tomcat's accessible utility method allowed malicious apps to bypass SecurityManager across many versions, indicating a significant oversight in core security design.
"a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications"
AFFECTED FEDRAMP PRODUCTS · 11
| PRODUCT | STATUS |
|---|---|
| Aconex for Defense Oracle |
Authorized |
| Cloud Insights NetApp |
In Process |
| Federal Managed Cloud Services Oracle |
Authorized |
| Fusion Cloud Oracle |
Authorized |
| Government Cloud - Common Controls Oracle |
Authorized |
| Oracle Cloud Infrastructure-Government Cloud Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) - Moderate Oracle |
In Process |
| Oracle Service Cloud Oracle |
Authorized |
| Oracle Service Cloud (DOD) Oracle |
Authorized |
| Taleo Cloud - U.S. Government Cloud Oracle |
Authorized |