Actively exploited · Published Apr 6, 2017 · Assigned by apache
CVE-2016-8735
Critical 9.8 Exploited
In plain English
A critical-severity security flaw in Apache Tomcat from Apache Software Foundation. Attackers are actively exploiting it in the wild (listed by CISA on May 12, 2023). The chance it is exploited in the next 30 days is estimated at 90.3% (higher than 99.8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)90.3%top 0.2% of all CVEs
Exploited in the wildYesCISA KEV since May 12, 2023
Attack toolingNoneno public tooling known
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jun 2, 2023.
Official description
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.tomcat:tomcat-catalina | 9.0.0.M12 | GHSA-cw54-59pw-4g8c |
| Maven | org.apache.tomcat:tomcat-catalina | 6.0.48 | GHSA-cw54-59pw-4g8c |
| Maven | org.apache.tomcat:tomcat-catalina | 7.0.73 | GHSA-cw54-59pw-4g8c |
| Maven | org.apache.tomcat:tomcat-catalina | 8.0.39 | GHSA-cw54-59pw-4g8c |
| Maven | org.apache.tomcat:tomcat-catalina | 8.5.7 | GHSA-cw54-59pw-4g8c |
| Maven | org.apache.tomcat:tomcat-catalina-jmx-remote | 6.0.48 | GHSA-cw54-59pw-4g8c |
| Maven | org.apache.tomcat:tomcat-catalina-jmx-remote | 7.0.73 | GHSA-cw54-59pw-4g8c |
| Maven | org.apache.tomcat:tomcat-catalina-jmx-remote | 8.0.39 | GHSA-cw54-59pw-4g8c |
| Maven | org.apache.tomcat:tomcat-catalina-jmx-remote | 8.5.7 | GHSA-cw54-59pw-4g8c |
| Maven | org.apache.tomcat:tomcat-catalina-jmx-remote | 9.0.0.M12 | GHSA-cw54-59pw-4g8c |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Tomcat | before 6.0.487.x before 7.0.738.x before 8.0.398.5.x before 8.5.79.x before 9.0.0.M12 |
References
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html x_refsource_CONFIRM
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html x_refsource_CONFIRM
- http://svn.apache.org/viewvc?view=revision&revision=1767676 x_refsource_CONFIRM
- http://tomcat.apache.org/security-9.html x_refsource_CONFIRM
- 1037331 vdb-entry, x_refsource_SECTRACK
- 94463 vdb-entry, x_refsource_BID
- DSA-3738 vendor-advisory, x_refsource_DEBIAN
- http://tomcat.apache.org/security-7.html x_refsource_CONFIRM
- http://svn.apache.org/viewvc?view=revision&revision=1767644 x_refsource_CONFIRM
- http://tomcat.apache.org/security-8.html x_refsource_CONFIRM
- http://svn.apache.org/viewvc?view=revision&revision=1767656 x_refsource_CONFIRM
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html x_refsource_CONFIRM
- https://security.netapp.com/advisory/ntap-20180607-0001/ x_refsource_CONFIRM
- http://tomcat.apache.org/security-6.html x_refsource_CONFIRM
- RHSA-2017:0457 vendor-advisory, x_refsource_REDHAT
- RHSA-2017:0455 vendor-advisory, x_refsource_REDHAT
- http://svn.apache.org/viewvc?view=revision&revision=1767684 x_refsource_CONFIRM
- RHSA-2017:0456 vendor-advisory, x_refsource_REDHAT
- http://seclists.org/oss-sec/2016/q4/502 x_refsource_CONFIRM
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list, x_refsource_MLIST
- [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list, x_refsource_MLIST
- [tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list, x_refsource_MLIST
- [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list, x_refsource_MLIST
- [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list, x_refsource_MLIST
- [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list, x_refsource_MLIST
- [tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list, x_refsource_MLIST
- [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list, x_refsource_MLIST
- [tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list, x_refsource_MLIST
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list, x_refsource_MLIST
- [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list, x_refsource_MLIST
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html x_refsource_MISC
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html x_refsource_MISC
- [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/ mailing-list, x_refsource_MLIST
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list, x_refsource_MLIST
- [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/ mailing-list, x_refsource_MLIST
- USN-4557-1 vendor-advisory, x_refsource_UBUNTU
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-8735 government-resource