CVE-2016-6797

Severity

Theme

CVE-2016-6797

high

New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.

ID	Name	Product	Family	Severity
141092	Ubuntu 16.04 LTS : Tomcat vulnerabilities (USN-4557-1)	Nessus	Ubuntu Local Security Checks	critical
103030	EulerOS 2.0 SP2 : tomcat (EulerOS-SA-2017-1192)	Nessus	Huawei Local Security Checks	critical
103029	EulerOS 2.0 SP1 : tomcat (EulerOS-SA-2017-1191)	Nessus	Huawei Local Security Checks	critical
102756	CentOS 7 : tomcat (CESA-2017:2247)	Nessus	CentOS Local Security Checks	high
102664	Scientific Linux Security Update : tomcat on SL7.x (noarch) (20170802)	Nessus	Scientific Linux Local Security Checks	high
102300	Oracle Linux 7 : tomcat (ELSA-2017-2247)	Nessus	Oracle Linux Local Security Checks	high
102115	RHEL 7 : tomcat (RHSA-2017:2247)	Nessus	Red Hat Local Security Checks	high
99930	Oracle Secure Global Desktop Multiple Vulnerabilities (April 2017 CPU) (SWEET32)	Nessus	Misc.	critical
97596	RHEL 7 : Red Hat JBoss Web Server 3.1.0 (RHSA-2017:0456)	Nessus	Red Hat Local Security Checks	critical
97595	RHEL 6 : Red Hat JBoss Web Server 3.1.0 (RHSA-2017:0455)	Nessus	Red Hat Local Security Checks	critical
96978	Ubuntu 12.04 LTS / 14.04 LTS : tomcat6, tomcat7 regression (USN-3177-2) (httpoxy)	Nessus	Ubuntu Local Security Checks	critical
96720	Ubuntu 12.04 LTS / 14.04 LTS / 16.04 LTS / 16.10 : tomcat6, tomcat7, tomcat8 vulnerabilities (USN-3177-1) (httpoxy)	Nessus	Ubuntu Local Security Checks	critical
96366	FreeBSD : tomcat -- multiple vulnerabilities (3ae106e2-d521-11e6-ae1b-002590263bf5)	Nessus	FreeBSD Local Security Checks	high
95791	openSUSE Security Update : tomcat (openSUSE-2016-1456)	Nessus	SuSE Local Security Checks	critical
95790	openSUSE Security Update : tomcat (openSUSE-2016-1455)	Nessus	SuSE Local Security Checks	critical
95455	Debian DLA-729-1 : tomcat7 security update	Nessus	Debian Local Security Checks	critical
95454	Debian DLA-728-1 : tomcat6 security update	Nessus	Debian Local Security Checks	critical
95034	Debian DSA-3721-1 : tomcat7 - security update	Nessus	Debian Local Security Checks	high
95033	Debian DSA-3720-1 : tomcat8 - security update	Nessus	Debian Local Security Checks	high
94997	Fedora 25 : 1:tomcat (2016-38e5b05260) (httpoxy)	Nessus	Fedora Local Security Checks	high
94748	Fedora 24 : 1:tomcat (2016-c1b01b9278) (httpoxy)	Nessus	Fedora Local Security Checks	high
94747	Fedora 23 : 1:tomcat (2016-4094bd4ad6) (httpoxy)	Nessus	Fedora Local Security Checks	high
94684	Amazon Linux AMI : tomcat6 / tomcat7,tomcat8 (ALAS-2016-764)	Nessus	Amazon Linux Local Security Checks	high
9723	Apache Tomcat 6.0.x < 6.0.47 / 7.0.x < 7.0.72 / 8.0.x < 8.0.37 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
9721	Apache Tomcat 8.5.x < 8.5.5 / 9.0.0.x < 9.0.0.M10 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
94578	Apache Tomcat 6.0.x < 6.0.47 / 7.0.x < 7.0.72 / 8.0.x < 8.0.37 / 8.5.x < 8.5.5 / 9.0.x < 9.0.0.M10 Multiple Vulnerabilities	Nessus	Web Servers	high

CVE-2016-6797

high

New! CVE Severity Now Using CVSS v3

Description

References

Details

Risk Information

CVSS v2

CVSS v3

Vulnerable Software

Configuration 1

Tenable Plugins

critical

critical

critical

high

high

high

high

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

high

high

high

high

high

high

medium

medium

high