The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade tomcat-el-2.2-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-javadocUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-jsvcUpgrade tomcat-lib | Oct 21, 2016 | Oct 11, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade tomcat-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-libUpgrade tomcat-el-2.2-apiUpgrade tomcat-admin-webapps | Nov 30, 2017 | Oct 13, 2016 |
| Oracle_linux | — | Upgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-jsvcUpgrade tomcat-el-2.2-apiUpgrade tomcat-javadocUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-lib | Oct 11, 2016 | Oct 10, 2016 |
| Redhat_linux | — | Upgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-libUpgrade tomcat-el-2.2-apiUpgrade tomcat-jsvcUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-docs-webappUpgrade tomcat-javadocUpgrade tomcat | Oct 21, 2016 | Oct 10, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub