Apache Software Foundation Apache Tomcat

CVE-2016-5018

CRITICAL 9.1

At a glance

Source: NVD
EPSS: EPSS 10.30 % · percentile 96 (2026-10-29)
State: PUBLISHED
Published: 2017-08-10 16:00 UTC
Updated: 2026-10-08 21:13 UTC
Assigner: apache
NVD status: Modified

Search on…

Description

In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	CRITICAL 9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 6.4	AV:N/AC:L/Au:N/C:P/I:P/A:N	NVD · nvd@nist.gov (Primary)

Advisories

GHSA-4v3g-g84w-hv7r — Authentication Bypass Using an Alternate Path or Channel in Apache Tomcat

European references

ENISA EUVD · EUVD-2022-2445
GCVE · GCVE-0-2016-5018

CERT-FR advisories

CERTFR-2025-AVI-0370 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2022-AVI-568 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 6.0.0 ≤ 6.0.45
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 7.0.0 ≤ 7.0.70
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 8.0 ≤ 8.0.36
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 8.5.0 ≤ 8.5.4
cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:tekelec_platform_distribution:*:*:*:*:*:*:*:* ≥ 7.4.0 ≤ 7.7.1

Affected products

Product	Versions
Apache Software Foundation · Apache Tomcat	affected 9.0.0.M1 to 9.0.0.M9 ; affected 8.5.0 to 8.5.4 ; affected 8.0.0.RC1 to 8.0.36 ; affected 7.0.0 to 7.0.70 ; affected 6.0.0 to 6.0.45

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

💣 Apache Software Foundation Apache Tomcat