vulnerability
Apache Tomcat: Important: Information Disclosure (CVE-2016-6816)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:N/AC:M/Au:N/C:P/I:P/A:P) | Nov 23, 2016 | Nov 23, 2016 | Aug 11, 2025 |
Severity
7
CVSS
(AV:N/AC:M/Au:N/C:P/I:P/A:P)
Published
Nov 23, 2016
Added
Nov 23, 2016
Modified
Aug 11, 2025
Description
The code that parsed the HTTP request line permitted invalid characters.
This could be exploited, in conjunction with a proxy that also permitted
the invalid characters but with a different interpretation, to inject
data into the HTTP response. By manipulating the HTTP response the
attacker could poison a web-cache, perform an XSS attack and/or obtain
sensitive information from requests other then their own.
Solutions
apache-tomcat-upgrade-6_0_48apache-tomcat-upgrade-7_0_73apache-tomcat-upgrade-8_0_39apache-tomcat-upgrade-8_5_8
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.