CVE-2016-5018
In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.
- CVSS 3.1
- 9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - EPSS
- 10% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-25)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:tomcat
- canonical:ubuntu_linux
- debian:debian_linux
- netapp:oncommand_insight
- netapp:oncommand_shift
- netapp:snap_creator_framework
- oracle:tekelec_platform_distribution
- redhat:enterprise_linux_desktop
- redhat:enterprise_linux_eus
- redhat:enterprise_linux_server
- redhat:enterprise_linux_server_aus
- redhat:enterprise_linux_server_tus
- redhat:enterprise_linux_workstation
- redhat:jboss_enterprise_application_platform
- redhat:jboss_enterprise_web_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-4v3g-g84w-hv7r | Maven | org.apache.tomcat:tomcat-jasper | >=9.0.0.M1 <9.0.0.M10 | 9.0.0.M10 |
| GHSA-4v3g-g84w-hv7r | Maven | org.apache.tomcat:tomcat-jasper | >=8.5.0 <8.5.5 | 8.5.5 |
| GHSA-4v3g-g84w-hv7r | Maven | org.apache.tomcat:tomcat-jasper | >=8.0.0RC1 <8.0.37 | 8.0.37 |
| GHSA-4v3g-g84w-hv7r | Maven | org.apache.tomcat:tomcat-jasper | >=7.0.0 <7.0.72 | 7.0.72 |
| GHSA-4v3g-g84w-hv7r | Maven | org.apache.tomcat:jasper | >=6.0.0 <6.0.47 | 6.0.47 |
| GHSA-4v3g-g84w-hv7r | Maven | org.apache.tomcat.embed:tomcat-embed-jasper | >=9.0.0.M1 <9.0.0.M10 | 9.0.0.M10 |
| GHSA-4v3g-g84w-hv7r | Maven | org.apache.tomcat.embed:tomcat-embed-jasper | >=8.5.0 <8.5.5 | 8.5.5 |
| GHSA-4v3g-g84w-hv7r | Maven | org.apache.tomcat.embed:tomcat-embed-jasper | >=8.0.0RC1 <8.0.37 | 8.0.37 |
| GHSA-4v3g-g84w-hv7r | Maven | org.apache.tomcat.embed:tomcat-embed-jasper | >=7.0.0 <7.0.72 | 7.0.72 |
| GHSA-4v3g-g84w-hv7r | Maven | org.apache.tomcat.embed:tomcat-embed-jasper | >=6.0.0 <6.0.47 | 6.0.47 |