vulnerability
FreeBSD: VID-3AE106E2-D521-11E6-AE1B-002590263BF5 (CVE-2016-6797): tomcat -- multiple vulnerabilities
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:N/AC:L/Au:N/C:P/I:N/A:N) | Oct 27, 2016 | Jan 8, 2017 | May 7, 2019 |
Severity
5
CVSS
(AV:N/AC:L/Au:N/C:P/I:N/A:N)
Published
Oct 27, 2016
Added
Jan 8, 2017
Modified
May 7, 2019
Description
The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.
Solutions
freebsd-upgrade-package-tomcatfreebsd-upgrade-package-tomcat7freebsd-upgrade-package-tomcat8
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.