CVE-2016-8735

critical-risk
Published 2017-04-06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

Do I need to act?

!
93.8% chance of exploitation in next 30 days
EPSS score — higher than 6% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
+
Fix available
Upgrade to: fe0424f91a9f0af2f6422fe83bfaa769d92aa131, b5205c92f41dfd9a67f78bc783db7b022e38226c
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (20)

Affected Vendors

Apache Netapp Oracle Debian Canonical Redhat

References (73)

Third Party Advisory http://rhn.redhat.com/errata/RHSA-2017-0457.html
Mailing List http://seclists.org/oss-sec/2016/q4/502
Broken Link http://svn.apache.org/viewvc?view=revision&revision=1767644
Broken Link http://svn.apache.org/viewvc?view=revision&revision=1767656
Broken Link http://svn.apache.org/viewvc?view=revision&revision=1767676
Broken Link http://svn.apache.org/viewvc?view=revision&revision=1767684
Release Notes http://tomcat.apache.org/security-6.html
Release Notes http://tomcat.apache.org/security-7.html
Release Notes http://tomcat.apache.org/security-8.html
Release Notes http://tomcat.apache.org/security-9.html
Mailing List http://www.debian.org/security/2016/dsa-3738
Patch http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
Patch http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
Patch http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
Broken Link http://www.securityfocus.com/bid/94463
Broken Link http://www.securitytracker.com/id/1037331
Third Party Advisory https://access.redhat.com/errata/RHSA-2017:0455
Third Party Advisory https://access.redhat.com/errata/RHSA-2017:0456
Mailing List https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e8...
Mailing List https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbea...
and 53 more references
85
/ 100
critical-risk
Severity 32/34 · Critical
Exploitability 27/34 · High
Exposure 26/34 · High