According to its self-reported version number, the Apache Tomcat service running on the remote host is 6.0.x prior to 6.0.47, 7.0.x prior to 7.0.72, 8.0.x prior to 8.0.37, 8.5.x prior to 8.5.5 or 9.0.x prior to 9.0.0.M10. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists due to a     failure to process passwords when paired with a     non-existent username. An unauthenticated, remote     attacker can exploit this, via a timing attack, to     enumerate user account names. (CVE-2016-0762)

  - A security bypass vulnerability exists that allows a     local attacker to bypass a configured SecurityManager     via a utility method that is accessible to web     applications. (CVE-2016-5018)

  - An information disclosure vulnerability exists in the     SecurityManager component due to a failure to properly     restrict access to system properties for the     configuration files system property replacement feature.
    An attacker can exploit this, via a specially crafted     web application, to bypass SecurityManager restrictions     and disclose system properties. (CVE-2016-6794)

  - A security bypass vulnerability exists that allows a     local attacker to bypass a configured SecurityManager by     changing the configuration parameters for a JSP servlet.
    (CVE-2016-6796)

  - A security bypass vulnerability exists due to a failure     to limit web application access to global JNDI     resources. A local attacker can exploit this to gain     unauthorized access to resources. (CVE-2016-6797)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

Apache Tomcat 6.0.x < 6.0.47 / 7.0.x < 7.0.72 / 8.0.x < 8.0.37 / 8.5.x < 8.5.5 / 9.0.x < 9.0.0.M10 Multiple Vulnerabilities

high Nessus Plugin ID 94578