CVE-2016-5018
Critical · CVSS 9.1- CVSS
- 9.1
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- NVD-CWE-noinfo
Description
In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.
Affected packages
| Maven | org.apache.tomcat.embed:tomcat-embed-jasper | 6.0.0 → 6.0.47 |
| Maven | org.apache.tomcat.embed:tomcat-embed-jasper | 7.0.0 → 7.0.72 |
| Maven | org.apache.tomcat.embed:tomcat-embed-jasper | 8.0.0RC1 → 8.0.37 |
| Maven | org.apache.tomcat.embed:tomcat-embed-jasper | 8.5.0 → 8.5.5 |
| Maven | org.apache.tomcat.embed:tomcat-embed-jasper | 9.0.0.M1 → 9.0.0.M10 |
| Maven | org.apache.tomcat:jasper | 6.0.0 → 6.0.47 |
| Maven | org.apache.tomcat:tomcat-jasper | 7.0.0 → 7.0.72 |
| Maven | org.apache.tomcat:tomcat-jasper | 8.0.0RC1 → 8.0.37 |
| Maven | org.apache.tomcat:tomcat-jasper | 8.5.0 → 8.5.5 |
| Maven | org.apache.tomcat:tomcat-jasper | 9.0.0.M1 → 9.0.0.M10 |
References
- http://packetstormsecurity.com/files/155873/Tomcat-9.0.0.M1-Sandbox-Escape.html
- http://rhn.redhat.com/errata/RHSA-2017-0457.html
- http://rhn.redhat.com/errata/RHSA-2017-1551.html
- http://www.debian.org/security/2016/dsa-3720
- http://www.securityfocus.com/bid/93942
- http://www.securitytracker.com/id/1037142
- http://www.securitytracker.com/id/1038757
- https://access.redhat.com/errata/RHSA-2017:0455
- https://access.redhat.com/errata/RHSA-2017:0456
- https://access.redhat.com/errata/RHSA-2017:1548
- https://access.redhat.com/errata/RHSA-2017:1549
- https://access.redhat.com/errata/RHSA-2017:1550
Status: profiled · ingested 2026-10-09T00:00:43.000Z