System Property Disclosure in Apache Tomcat
When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2016-6794US | medium5.3 | — | ||
When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://rhn.redhat.com/errata/RHSA-2017-0457.htmlWEB
- http://www.debian.org/security/2016/dsa-3720WEB
- https://access.redhat.com/errata/RHSA-2017:0455WEB
- https://access.redhat.com/errata/RHSA-2017:0456WEB
- https://access.redhat.com/errata/RHSA-2017:2247WEB
- https://github.com/apache/tomcatPACKAGE
- https://github.com/apache/tomcat/commit/0b41766456b1980e4f809e13ad6dc9fa912bae7eWEB
- https://github.com/apache/tomcat/commit/c1660182010b4255c21c874d69c124370a67784aWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan