Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | amazon-linux-upgrade-tomcat6amazon-linux-upgrade-tomcat7amazon-linux-upgrade-tomcat8 | Dec 16, 2016 | Dec 10, 2016 |
| Apache Tomcat | apache-tomcat-upgrade-6_0_48apache-tomcat-upgrade-7_0_73apache-tomcat-upgrade-8_0_39apache-tomcat-upgrade-8_5_8apache-tomcat-upgrade-9_0_0apache-tomcat-6_0apache-tomcat-7_0apache-tomcat-8_0apache-tomcat-8_5apache-tomcat-9_0apache-tomcat-upgrade-latest | Apr 6, 2017 | Apr 6, 2017 | |
| Arch Linux | View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗ | arch-linux-upgrade-latest | Jul 11, 2025 | Apr 6, 2017 |
| Debian | debian-upgrade-tomcat6debian-upgrade-tomcat7 | Dec 19, 2016 | Dec 10, 2016 | |
| Freebsd | freebsd-upgrade-package-tomcatfreebsd-upgrade-package-tomcat7freebsd-upgrade-package-tomcat8 | Jan 8, 2017 | Jan 7, 2017 | |
| Oracle Missing Cpu Oct 2017 | oracle-apply-oct-2017-cpu | Oct 18, 2017 | Apr 6, 2017 | |
| Oracle Solaris | oracle-solaris-11-3-upgrade-web-java-servlet-tomcat-6-0-48-0-175-3-16-0-2-0oracle-solaris-11-3-upgrade-web-java-servlet-tomcat-8-8-5-9-0-175-3-16-0-3-0oracle-solaris-11-3-upgrade-web-java-servlet-tomcat-8-tomcat-admin-8-5-9-0-175-3-16-0-3-0oracle-solaris-11-3-upgrade-web-java-servlet-tomcat-8-tomcat-examples-8-5-9-0-175-3-16-0-3-0oracle-solaris-11-3-upgrade-web-java-servlet-tomcat-tomcat-examples-6-0-48-0-175-3-16-0-2-0 | May 29, 2017 | Apr 6, 2017 | |
| Suse | — | suse-upgrade-tomcatsuse-upgrade-tomcat-admin-webappssuse-upgrade-tomcat-docs-webappsuse-upgrade-tomcat-el-2_2-apisuse-upgrade-tomcat-el-3_0-apisuse-upgrade-tomcat-javadocsuse-upgrade-tomcat-jsp-2_2-apisuse-upgrade-tomcat-jsp-2_3-apisuse-upgrade-tomcat-libsuse-upgrade-tomcat-servlet-3_0-apisuse-upgrade-tomcat-servlet-3_1-apisuse-upgrade-tomcat-servlet-4_0-apisuse-upgrade-tomcat-webappssuse-upgrade-tomcat6suse-upgrade-tomcat6-admin-webappssuse-upgrade-tomcat6-docs-webappsuse-upgrade-tomcat6-javadocsuse-upgrade-tomcat6-jsp-2_1-apisuse-upgrade-tomcat6-libsuse-upgrade-tomcat6-servlet-2_5-apisuse-upgrade-tomcat6-webapps | Dec 12, 2016 | Dec 10, 2016 |
| Ubuntu | ubuntu-pro-upgrade-libservlet2-5-javaubuntu-upgrade-libservlet2-5-javaubuntu-upgrade-libtomcat6-javaubuntu-upgrade-libtomcat7-javaubuntu-upgrade-libtomcat8-javaubuntu-upgrade-tomcat6ubuntu-upgrade-tomcat7ubuntu-upgrade-tomcat8 | Jan 24, 2017 | Dec 10, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub