vulnerability
Red Hat JBoss EAP: CVE-2016-0763: Other
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 4 | (AV:A/AC:M/Au:N/C:P/I:P/A:N) | Feb 22, 2016 | Sep 19, 2024 | Jun 19, 2025 |
Severity
4
CVSS
(AV:A/AC:M/Au:N/C:P/I:P/A:N)
Published
Feb 22, 2016
Added
Sep 19, 2024
Modified
Jun 19, 2025
Description
The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.. A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service.
Solution
red-hat-jboss-eap-upgrade-latest
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.