vulnerability
Apache Tomcat: Important: Remote Code Execution (CVE-2016-8735)
Severity | CVSS | Published | Added | Modified |
---|---|---|---|---|
8 | (AV:N/AC:L/Au:N/C:P/I:P/A:P) | Nov 23, 2016 | Nov 23, 2016 | May 5, 2025 |
Severity
8
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
Nov 23, 2016
Added
Nov 23, 2016
Modified
May 5, 2025
Description
The JmxRemoteLifecycleListener was not updated to take
account of Oracle's fix for CVE-2016-3427. Therefore, Tomcat
installations using this listener remained vulnerable to a similar remote
code execution vulnerability. This issue has been rated as important
rather than critical due to the small number of installations using this
listener and that it would be highly unusual for the JMX ports to be
accessible to an attacker even when the listener is used.
Solution(s)
apache-tomcat-upgrade-6_0_48apache-tomcat-upgrade-7_0_73apache-tomcat-upgrade-8_0_39apache-tomcat-upgrade-8_5_8

NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.