High severity · published Aug 10, 2017
CVE-2016-6797
The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web…
7.5
CVSS
8.1%
EPSS
No
On KEV
Description
The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)8.1% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
Tomcat · Apache
9.0.0.M1 to 9.0.0.M9; 8.5.0 to 8.5.4; 8.0.0.RC1 to 8.0.36; 7.0.0 to 7.0.70; 6.0.0 to 6.0.45 · source: vendor, NVD
DL
Debian Linux · Debian
8.0 · source: NVD
EL
Enterprise Linux Desktop · Redhat
7.0 · source: NVD
EL
Enterprise Linux Eus · Redhat
7.4; 7.5; 7.6; 7.7 · source: NVD
EL
Enterprise Linux Server · Redhat
7.0 · source: NVD
EL
Enterprise Linux Server Aus · Redhat
7.4; 7.6; 7.7 · source: NVD
EL
Enterprise Linux Server Tus · Redhat
7.6; 7.7 · source: NVD
EL
Enterprise Linux Workstation · Redhat
7.0 · source: NVD
JE
Jboss Enterprise Web Server · Redhat
3.0.0 · source: NVD
OI
Oncommand Insight · Netapp
All versions, or not specified · source: NVD
OS
Oncommand Shift · Netapp
All versions, or not specified · source: NVD
SC
Snap Creator Framework · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-6797
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-6797
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0457.html
Third Party Advisory
http://www.debian.org/security/2016/dsa-3720
Broken Link
http://www.securityfocus.com/bid/93940
Broken Link
http://www.securitytracker.com/id/1037145
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:0455
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:0456
More from Tomcat
9.8
CVE-2025-24813
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
9.8
CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
9.8
CVE-2016-8735
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…
8.1
CVE-2017-12617
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g
8.1
CVE-2017-12615
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g