CVE-2014-7810: Medium severity debian linux vulnerability
It was found that the expression language resolver evaluated expressions within a privileged code section. A malicious web application could use this flaw to bypass security manager protections.
Upstream patches:
http://svn.apache.org/viewvc?view=revision&revision=1644019 http://svn.apache.org/viewvc?view=revision&revision=1645644
External References:
http://tomcat.apache.org/security-6.html#FixedinApacheTomcat6.0.44 http://tomcat.apache.org/security-7.html#FixedinApacheTomcat7.0.59 http://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.0.17
Other sources
The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-7810?
CVE-2014-7810 has a severity rating that indicates it can be exploited to bypass security manager protections.
How do I fix CVE-2014-7810?
To fix CVE-2014-7810, upgrade to Apache Tomcat versions 6.0.41, 7.0.59, or 8.0.17 or later.
What versions of Apache Tomcat are affected by CVE-2014-7810?
CVE-2014-7810 affects Apache Tomcat versions 6.0.0 to 6.0.41, 7.0.0 to 7.0.59, and 8.0.0 to 8.0.17.
Can CVE-2014-7810 be exploited remotely?
Yes, CVE-2014-7810 can be exploited remotely by malicious web applications.
Is there any workaround for CVE-2014-7810?
There is no known workaround for CVE-2014-7810; upgrading to a patched version is recommended.