CVE-2016-0714: High severity tomcat vulnerability
The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.
Other sources
Tomcat provides several session persistence mechanisms. The StandardManager persists session over a restart. The PersistentManager is able to persist sessions to files, a database or a custom Store. The Cluster implementation persists sessions to one or more additional nodes in the cluster. All of these mechanisms could be exploited to bypass a security manager. Session persistence is performed by Tomcat code with the permissions assigned to Tomcat internal code. By placing a carefully crafted object into a session, a malicious web application could trigger the execution of arbitrary code.
External references:
http://seclists.org/bugtraq/2016/Feb/145
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-0714?
CVE-2016-0714 has a severity level classified as moderate.
How do I fix CVE-2016-0714?
To fix CVE-2016-0714, upgrade to Apache Tomcat version 6.0.45, 7.0.68, 8.0.31, or 9.0.0.M2 or later.
What versions of Apache Tomcat are affected by CVE-2016-0714?
CVE-2016-0714 affects Apache Tomcat versions 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2.
What type of vulnerability is CVE-2016-0714?
CVE-2016-0714 is a vulnerability in session persistence implementation that can allow code execution by remote authenticated users.
Can I still use Apache Tomcat if it's vulnerable to CVE-2016-0714?
It is strongly advised not to use vulnerable versions of Apache Tomcat, as they pose a security risk allowing unauthorized code execution.