The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for (1) /etc/sysconfig/tomcat and (2) /etc/tomcat/tomcat.conf, which allows local users to gain privileges by leveraging membership in the tomcat group.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade tomcat7Upgrade tomcat8Upgrade tomcat6 | Nov 11, 2016 | Oct 13, 2016 |
| Centos_linux | — | Upgrade tomcatUpgrade tomcat-javadocUpgrade tomcat-jsp-2.2-apiUpgrade tomcat6Upgrade tomcat-servlet-3.0-apiUpgrade tomcat6-servlet-2.5-apiUpgrade tomcat-docs-webappUpgrade tomcat6-javadocUpgrade tomcat6-webappsUpgrade tomcat-jsvcUpgrade tomcat-el-2.2-apiUpgrade tomcat6-libUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat6-admin-webappsUpgrade tomcat6-el-2.1-apiUpgrade tomcat6-docs-webappUpgrade tomcat-libUpgrade tomcat6-jsp-2.1-api | Oct 21, 2016 | Oct 11, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade tomcat-el-2.2-apiUpgrade tomcatUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-libUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-webappsUpgrade tomcat-admin-webapps | Nov 30, 2017 | Oct 13, 2016 |
| Oracle_linux | — | Upgrade tomcat-javadocUpgrade tomcat6-el-2.1-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat6-docs-webappUpgrade tomcat-servlet-3.0-apiUpgrade tomcat6-servlet-2.5-apiUpgrade tomcat6-libUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat6-javadocUpgrade tomcat-jsp-2.2-apiUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat6-webappsUpgrade tomcat6-admin-webappsUpgrade tomcat-libUpgrade tomcat6-jsp-2.1-apiUpgrade tomcat6Upgrade tomcat-jsvc | Jul 1, 2017 | Oct 10, 2016 |
| Redhat_linux | — | Upgrade tomcat6-docs-webappUpgrade tomcat6-servlet-2.5-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat6-javadocUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-libUpgrade tomcat-javadocUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat6-webappsUpgrade tomcat6-el-2.1-apiUpgrade tomcatUpgrade tomcat6No solution existsUpgrade tomcat-jsvcUpgrade tomcat6-admin-webappsUpgrade tomcat6-libUpgrade tomcat-docs-webappUpgrade tomcat-webappsUpgrade tomcat6-jsp-2.1-api | Oct 21, 2016 | Oct 10, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub