NVD

Id
17097  
Name
CVE-2016-0706  
Description
Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.  
Reject
 
CVSS Version
2  
CVSS Score
4  
Severity
Medium  
CVSS Base Score
4  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2016-02-24  
Modified Date
2016-12-05  
Seq
2016-0706  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
94770 17097 CVE-2016-0706 SUSE-SU-2016:0769  View
94771 17097 CVE-2016-0706 SUSE-SU-2016:0822  View
94772 17097 CVE-2016-0706 SUSE-SU-2016:0839  View
94773 17097 CVE-2016-0706 openSUSE-SU-2016:0865  View
94774 17097 CVE-2016-0706 HPSBUX03561  View
94775 17097 CVE-2016-0706 RHSA-2016:1089  View
94776 17097 CVE-2016-0706 RHSA-2016:2045  View
94777 17097 CVE-2016-0706 20160222 [SECURITY] CVE-2016-0706 Apache Tomcat Security Manager bypass  View
94778 17097 CVE-2016-0706 http://svn.apache.org/viewvc?view=revision&revision=1722799  View
94779 17097 CVE-2016-0706 http://svn.apache.org/viewvc?view=revision&revision=1722800  View
94780 17097 CVE-2016-0706 http://svn.apache.org/viewvc?view=revision&revision=1722801  View
94781 17097 CVE-2016-0706 http://svn.apache.org/viewvc?view=revision&revision=1722802  View
94782 17097 CVE-2016-0706 http://tomcat.apache.org/security-6.html  View
94783 17097 CVE-2016-0706 http://tomcat.apache.org/security-7.html  View
94784 17097 CVE-2016-0706 http://tomcat.apache.org/security-8.html  View
94785 17097 CVE-2016-0706 http://tomcat.apache.org/security-9.html  View
94786 17097 CVE-2016-0706 DSA-3530  View
94787 17097 CVE-2016-0706 DSA-3552  View
94788 17097 CVE-2016-0706 DSA-3609  View
94789 17097 CVE-2016-0706 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html  View
94790 17097 CVE-2016-0706 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html  View
94791 17097 CVE-2016-0706 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html  View
94792 17097 CVE-2016-0706 83324  View
94793 17097 CVE-2016-0706 1035069  View
94794 17097 CVE-2016-0706 USN-3024-1  View
94795 17097 CVE-2016-0706 RHSA-2016:1087  View
94796 17097 CVE-2016-0706 RHSA-2016:1088  View
94797 17097 CVE-2016-0706 https://bto.bluecoat.com/security-advisory/sa118  View
94798 17097 CVE-2016-0706 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964  View
94799 17097 CVE-2016-0706 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442  View
94800 17097 CVE-2016-0706 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
773 JVNDB-2016-001546 Apache Tomcat における SecurityManager の制限を回避される脆弱性 Apache Tomcat は、org.apache.catalina.manager.StatusManagerServlet を org/apache/catalina/core/RestrictedServlets.properties リスト上に配置しないため、SecurityManager の制限を回避され、任意の HTTP リクエストを読まれ、その結果、セッション ID の値を取得される脆弱性が存在します。 CVE-2016-0706 86910 CVE-2016-0706 17097 4 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-001546.html 2016-01-05 2016-11-21 View