Detections
Analytics

SCA: security update for org.apache.tomcat:tomcat-coyote (GHSA-jc7p-5r39-9477)

high Tenable Cloud Security Plugin ID 416287

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and
 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited,
 in conjunction with a proxy that also permitted the invalid characters but with a different
 interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker
 could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other
 then their own. (CVE-2016-6816)

See Also

https://github.com/advisories/GHSA-jc7p-5r39-9477

Plugin Details

Severity: High

ID: 416287

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5.8

Percentile: 96.62

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2016-6816

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/13/2022

Vulnerability Publication Date: 11/8/2016

Reference Information

CVE: CVE-2016-6816

BID: 94461

cwe: CWE-20