netVigilance Vulnerability intelligence since 2004
CVE-2016-8735 · netVigilance record NV23-0063

Apache Tomcat Remote Code Execution

past due

What to do

Apply updates per vendor instructions.

CISA deadline 2023-06-02 · passed 3 years 3 months ago · applies to US federal civilian agencies; used elsewhere as a reference SLA

What happened

Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.

Who is affected

Apache Tomcat. Affected version ranges are listed in the vendor advisory and the NVD entry linked under Sources.

Weakness class: CWE-284.

Timeline

  1. Added to CISA KEVExploitation in the wild confirmed by CISA
  2. CISA remediation deadlinepassed 3 years 3 months ago

Sources