The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade tomcatUpgrade tomcat-javadocUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-docs-webappUpgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-jsvc | Oct 21, 2016 | Oct 11, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade tomcatUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-lib | Nov 30, 2017 | Oct 13, 2016 |
| Oracle_linux | — | Upgrade tomcat-docs-webappUpgrade tomcat-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-jsvcUpgrade tomcat-el-2.2-apiUpgrade tomcat-libUpgrade tomcat-javadocUpgrade tomcat-jsp-2.2-api | Oct 11, 2016 | Oct 10, 2016 |
| Redhat_linux | — | Upgrade tomcat-servlet-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-docs-webappUpgrade tomcat-el-2.2-apiUpgrade tomcat-jsvcUpgrade tomcatUpgrade tomcat-javadoc | Oct 21, 2016 | Oct 10, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub