The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-javadocUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-jsvc | Oct 21, 2016 | Oct 11, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade tomcat-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-lib | Nov 30, 2017 | Oct 13, 2016 |
| Oracle_linux | — | Upgrade tomcat-jsp-2.2-apiUpgrade tomcat-jsvcUpgrade tomcat-javadocUpgrade tomcat-el-2.2-apiUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade tomcat-servlet-3.0-apiUpgrade tomcat | Oct 11, 2016 | Oct 10, 2016 |
| Redhat_linux | — | Upgrade tomcat-el-2.2-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-javadocUpgrade tomcat-jsvcUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-webapps | Oct 21, 2016 | Oct 10, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub