CVE-2016-0714

CVE-2016-0714

Publicada em · Atualizada em

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 13%
probabilidade de exploração
13%top 4% das CVEs
exploração observada
nãonenhuma fonte reporta
The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.
Produtos afetados
n/a · n/a
Referências
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.htmlhttp://marc.info/?l=bugtraq&m=145974991225029&w=2http://rhn.redhat.com/errata/RHSA-2016-1089.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2045.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2599.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2807.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2808.htmlhttps://access.redhat.com/errata/RHSA-2016:1087https://access.redhat.com/errata/RHSA-2016:1088