The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-el-2.2-apiUpgrade tomcat-javadocUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-jsvcUpgrade tomcat-webapps | Oct 21, 2016 | Oct 11, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade tomcat-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-libUpgrade tomcat-el-2.2-apiUpgrade tomcat-admin-webapps | Nov 30, 2017 | Oct 13, 2016 |
| Oracle_linux | — | Upgrade tomcat-admin-webappsUpgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-jsvcUpgrade tomcat-javadoc | Oct 11, 2016 | Oct 10, 2016 |
| Redhat_linux | — | Upgrade tomcat-el-2.2-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-javadocUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-jsvcUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-lib | Oct 21, 2016 | Oct 10, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub