New! Vulnerability Priority Rating (VPR)
Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.
VPR Score: 5.9
SynopsisThe remote device is missing a vendor-supplied security patch.
DescriptionThe session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session. (CVE-2016-0714)
A remote authenticated user may bypass the intended security manager restrictions and execute arbitrary code in a privileged context by exploiting this vulnerability via a web application that places a crafted object in a session.
BIG-IP and Enterprise Manager systems do not use the affected feature.
The vulnerable software is present; however, the software is not used in a way that exposes this vulnerability.
Traffix SDC Exploitation of this vulnerability may occur if an attacker has access to the local network of the system; the Tomcat service is accessible only from the internal network.
SolutionUpgrade to one of the non-vulnerable versions listed in the F5 Solution K58084500.