Attacker Value
Unknown
CVE-2016-8735
CVE-2016-8735
(Last updated June 28, 2024) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn’t updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
9.8 Critical
Impact Score:
5.9
Exploitability Score:
3.9
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High
General Information
Products
- 7-mode transition tool -,
- agile engineering data management 6.1.3,
- agile engineering data management 6.2.0,
- agile engineering data management 6.2.1.0,
- agile plm 9.3.5,
- agile plm 9.3.6,
- communications application session controller 3.7.1,
- communications application session controller 3.8.0,
- communications instant messaging server 10.0.1,
- communications interactive session recorder 6.0,
- communications interactive session recorder 6.1,
- communications interactive session recorder 6.2,
- debian linux 8.0,
- hospitality guest access 4.2.0,
- hospitality guest access 4.2.1,
- jboss enterprise web server 3.0.0,
- micros relate crm software 10.8,
- micros relate crm software 11.4,
- micros retail xbri loss prevention 10.0.1,
- micros retail xbri loss prevention 10.5.0,
- micros retail xbri loss prevention 10.6.0,
- micros retail xbri loss prevention 10.7.7,
- micros retail xbri loss prevention 10.8.0,
- micros retail xbri loss prevention 10.8.1,
- mysql enterprise monitor,
- oncommand insight -,
- oncommand shift -,
- retail convenience and fuel pos software 2.1.132,
- snap creator framework -,
- tomcat,
- tomcat 9.0.0,
- transportation management 6.3.0,
- transportation management 6.3.1,
- transportation management 6.3.2,
- transportation management 6.3.3,
- transportation management 6.3.4,
- transportation management 6.3.5,
- transportation management 6.3.6,
- transportation management 6.3.7,
- ubuntu linux 16.04
Exploited in the Wild
References
Advisory
