vulnerability

Apache Tomcat: Important: Remote Code Execution (CVE-2016-8735)

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
Nov 23, 2016
Added
Nov 23, 2016
Modified
May 5, 2025

Description

The JmxRemoteLifecycleListener was not updated to take
account of Oracle's fix for CVE-2016-3427. Therefore, Tomcat
installations using this listener remained vulnerable to a similar remote
code execution vulnerability. This issue has been rated as important
rather than critical due to the small number of installations using this
listener and that it would be highly unusual for the JMX ports to be
accessible to an attacker even when the listener is used.

Solution(s)

apache-tomcat-upgrade-6_0_48apache-tomcat-upgrade-7_0_73apache-tomcat-upgrade-8_0_39apache-tomcat-upgrade-8_5_8
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.