CVE-2016-0706: Infoleak
Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.
Other sources
The StatusManagerServlet could be loaded by a web application when a security manager was configured. This servlet would then provide the web application with a list of all deployed applications and a list of the HTTP request lines for all requests currently being processed. This could have exposed sensitive information from other web applications such as session IDs to the web application.
External references:
http://seclists.org/bugtraq/2016/Feb/144
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-0706?
CVE-2016-0706 is considered a moderate severity vulnerability that allows unauthorized access to sensitive information.
How do I fix CVE-2016-0706?
To fix CVE-2016-0706, upgrade Apache Tomcat to versions 6.0.45, 7.0.68, 8.0.31, or 9.0.0.M2 or later.
What versions of Apache Tomcat are affected by CVE-2016-0706?
CVE-2016-0706 affects Apache Tomcat versions 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2.
Who can exploit CVE-2016-0706?
CVE-2016-0706 can be exploited by remote authenticated users to bypass configured security settings.
What are the consequences of exploiting CVE-2016-0706?
Exploitation of CVE-2016-0706 could lead to unauthorized access to sensitive management information on the server.