CVE-2016-6797

Apache Software Foundation Apache Tomcat

HIGH 7.5

En bref

Source: NVD
EPSS: EPSS 8.07 % · centile 95 (2026-10-28)
État: PUBLISHED
Publiée: 2017-08-10 22:00 UTC
Mise à jour: 2026-10-08 21:13 UTC
Attribuée par: apache
Statut NVD: Modified

Description

The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.

Faiblesses (CWE)

CWE-863 — Autorisation incorrecte

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N	NVD · nvd@nist.gov (Primary)

Avis

GHSA-q6x7-f33r-3wxx — Incorrect Authorization in Apache Tomcat

Références européennes

ENISA EUVD · EUVD-2022-4905
GCVE · GCVE-0-2016-6797

Avis du CERT-FR

CERTFR-2025-AVI-0370 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2022-AVI-568 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 6.0.0 ≤ 6.0.45
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 7.0.0 ≤ 7.0.70
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 8.0 ≤ 8.0.36
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 8.5.0 ≤ 8.5.4
cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*
cpe:2.3:a:oracle:tekelec_platform_distribution:*:*:*:*:*:*:*:* ≥ 7.4.0 ≤ 7.7.1
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
Apache Software Foundation · Apache Tomcat	affected 9.0.0.M1 to 9.0.0.M9 ; affected 8.5.0 to 8.5.4 ; affected 8.0.0.RC1 to 8.0.36 ; affected 7.0.0 to 7.0.70 ; affected 6.0.0 to 6.0.45

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD