CVE-2016-5018

Critical

Published: 10/08/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In Apache Tomcat versions from 6.0.0 to 9.0.0.M9, a vulnerability allowed a malicious web application to bypass a configured SecurityManager via a Tomcat utility method accessible to web applications.

Risk Assessment

This threat could lead to unauthorized access to system resources, posing a risk to the security of data and applications within the organization.

Recommendation

It is recommended to update Apache Tomcat to the latest version to eliminate this vulnerability and review the SecurityManager configuration to enhance security.

Original NVD description (English source)

In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.