CVE-2016-5018

MEDIUM

Description

In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.

ID	Name	Product	Family	Severity
112260	RHEL 7 : JBoss EAP (RHSA-2017:1548)	Nessus	Red Hat Local Security Checks	medium
103030	EulerOS 2.0 SP2 : tomcat (EulerOS-SA-2017-1192)	Nessus	Huawei Local Security Checks	medium
103029	EulerOS 2.0 SP1 : tomcat (EulerOS-SA-2017-1191)	Nessus	Huawei Local Security Checks	medium
102756	CentOS 7 : tomcat (CESA-2017:2247)	Nessus	CentOS Local Security Checks	medium
102664	Scientific Linux Security Update : tomcat on SL7.x (noarch)	Nessus	Scientific Linux Local Security Checks	medium
102300	Oracle Linux 7 : tomcat (ELSA-2017-2247)	Nessus	Oracle Linux Local Security Checks	medium
102115	RHEL 7 : tomcat (RHSA-2017:2247)	Nessus	Red Hat Local Security Checks	medium
100982	RHEL 5 : JBoss EAP (RHSA-2017:1550)	Nessus	Red Hat Local Security Checks	medium
100981	RHEL 6 : JBoss EAP (RHSA-2017:1549)	Nessus	Red Hat Local Security Checks	medium
100949	RHEL 6 : jboss-ec2-eap (RHSA-2017:1552)	Nessus	Red Hat Local Security Checks	medium
99930	Oracle Secure Global Desktop Multiple Vulnerabilities (April 2017 CPU) (SWEET32)	Nessus	Misc.	critical
97596	RHEL 7 : Red Hat JBoss Web Server 3.1.0 (RHSA-2017:0456)	Nessus	Red Hat Local Security Checks	high
97595	RHEL 6 : Red Hat JBoss Web Server 3.1.0 (RHSA-2017:0455)	Nessus	Red Hat Local Security Checks	high
96978	Ubuntu 12.04 LTS / 14.04 LTS : tomcat6, tomcat7 regression (USN-3177-2) (httpoxy)	Nessus	Ubuntu Local Security Checks	high
96720	Ubuntu 12.04 LTS / 14.04 LTS / 16.04 LTS / 16.10 : tomcat6, tomcat7, tomcat8 vulnerabilities (USN-3177-1) (httpoxy)	Nessus	Ubuntu Local Security Checks	high
96366	FreeBSD : tomcat -- multiple vulnerabilities (3ae106e2-d521-11e6-ae1b-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium
95791	openSUSE Security Update : tomcat (openSUSE-2016-1456)	Nessus	SuSE Local Security Checks	high
95790	openSUSE Security Update : tomcat (openSUSE-2016-1455)	Nessus	SuSE Local Security Checks	high
95455	Debian DLA-729-1 : tomcat7 security update	Nessus	Debian Local Security Checks	high
95454	Debian DLA-728-1 : tomcat6 security update	Nessus	Debian Local Security Checks	high
95034	Debian DSA-3721-1 : tomcat7 - security update	Nessus	Debian Local Security Checks	medium
95033	Debian DSA-3720-1 : tomcat8 - security update	Nessus	Debian Local Security Checks	medium
94997	Fedora 25 : 1:tomcat (2016-38e5b05260) (httpoxy)	Nessus	Fedora Local Security Checks	high
94748	Fedora 24 : 1:tomcat (2016-c1b01b9278) (httpoxy)	Nessus	Fedora Local Security Checks	high
94747	Fedora 23 : 1:tomcat (2016-4094bd4ad6) (httpoxy)	Nessus	Fedora Local Security Checks	high
94684	Amazon Linux AMI : tomcat6 / tomcat7,tomcat8 (ALAS-2016-764)	Nessus	Amazon Linux Local Security Checks	high
94578	Apache Tomcat 6.0.x < 6.0.47 / 7.0.x < 7.0.72 / 8.0.x < 8.0.37 / 8.5.x < 8.5.5 / 9.0.x < 9.0.0.M10 Multiple Vulnerabilities	Nessus	Web Servers	medium
9723	Apache Tomcat 6.x < 6.0.47 / 7.x < 7.0.72 / 8.x < 8.0.37 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
9721	Apache Tomcat 8.5.x < 8.5.5 / 9.x < 9.0.0.M10 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium

CVE-2016-5018

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0