Unscored severity · published Jun 7, 2015
CVE-2014-7810
The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an…
–
CVSS
13.3%
EPSS
No
On KEV
Description
The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.
Exploitation
Is it being used?
Exploit prediction (EPSS)13.3% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
Tomcat · Apache
6.0.0; 6.0.0; 6.0.1; 6.0.1; 6.0.2; 6.0.2; +34 more · source: NVD
DL
Debian Linux · Debian
7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-7810
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-7810
Third Party Advisory
http://marc.info/?l=bugtraq&m=145974991225029&w=2
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-1621.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-1622.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2016-0492.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2016-2046.html
Patch
http://svn.apache.org/viewvc?view=revision&revision=1644018
More from Tomcat
9.8
CVE-2025-24813
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
9.8
CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
9.8
CVE-2016-8735
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…
8.1
CVE-2017-12617
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g
8.1
CVE-2017-12615
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g