CVE-2016-6794: Medium severity Apache Tomcat vulnerability
Last updated 18 August 2025
Other sources
The following flaw was found in Tomcat:
When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. Tomcat's system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.
Upstream patches:
6.0.47: https://svn.apache.org/viewvc?view=revision&revision=1754733 7.0.72: https://svn.apache.org/viewvc?view=revision&revision=1754728 8.5.5: https://svn.apache.org/viewvc?view=revision&revision=1754726 8.0.37: https://svn.apache.org/viewvc?view=revision&revision=1754727
External References:
https://tomcat.apache.org/security-6.html#FixedinApacheTomcat6.0.47 https://tomcat.apache.org/security-7.html#FixedinApacheTomcat7.0.72 https://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.5.5and8.0.37
— Red Hat
When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 6.0.47 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 7.0.72 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 8.5.5 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 8.0.37 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 9.0.0.M10 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 8.5.5 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 8.0.37 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 7.0.72 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 6.0.47 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 6.0.47Patch 1754733 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 7.0.72Patch 1754728 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 8.0.37Patch 1754727 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 8.5.5Patch 1754726
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6794?
CVE-2016-6794 is classified as a moderate severity vulnerability.
How do I fix CVE-2016-6794?
To fix CVE-2016-6794, update Tomcat to version 6.0.47 or later, 7.0.72 or later, 8.0.37 or later, or 8.5.5 or later.
What systems are affected by CVE-2016-6794?
CVE-2016-6794 affects Apache Tomcat versions prior to 6.0.47, 7.0.72, 8.0.37, and 8.5.5, as well as earlier milestone versions of Tomcat 9.0.
What does CVE-2016-6794 exploit?
CVE-2016-6794 exploits the improper control of a web application’s ability to read system properties when a SecurityManager is configured.
Is there a workaround for CVE-2016-6794?
While updating to the fixed versions is recommended, temporarily disabling the system property replacement feature in Tomcat can mitigate some risks associated with CVE-2016-6794.