vulnerability
Apache Tomcat: Important: Remote Code Execution (CVE-2016-8735)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 8 | (AV:N/AC:L/Au:N/C:P/I:P/A:P) | 2016-11-23 | 2016-11-23 | 2025-05-05 |
Severity
8
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
2016-11-23
Added
2016-11-23
Modified
2025-05-05
Description
The JmxRemoteLifecycleListener was not updated to take
account of Oracle's fix for CVE-2016-3427. Therefore, Tomcat
installations using this listener remained vulnerable to a similar remote
code execution vulnerability. This issue has been rated as important
rather than critical due to the small number of installations using this
listener and that it would be highly unusual for the JMX ports to be
accessible to an attacker even when the listener is used.
Solution(s)
apache-tomcat-upgrade-6_0_48apache-tomcat-upgrade-7_0_73apache-tomcat-upgrade-8_0_39apache-tomcat-upgrade-8_5_8
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.