Attacker Value
Unknown
CVE-2016-6796
CVE-2016-6796
(Last updated December 09, 2023) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
7.5 High
Impact Score:
3.6
Exploitability Score:
3.9
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
None
Integrity (I):
High
Availability (A):
None
General Information
Vendors
- apache,
- canonical,
- debian,
- netapp,
- oracle,
- redhat
Products
- debian linux 8.0,
- enterprise linux desktop 7.0,
- enterprise linux eus 7.4,
- enterprise linux eus 7.5,
- enterprise linux eus 7.6,
- enterprise linux eus 7.7,
- enterprise linux server 7.0,
- enterprise linux server aus 7.4,
- enterprise linux server aus 7.6,
- enterprise linux server aus 7.7,
- enterprise linux server tus 7.6,
- enterprise linux server tus 7.7,
- enterprise linux workstation 7.0,
- jboss enterprise application platform 6.4,
- jboss enterprise web server 3.0.0,
- oncommand insight -,
- oncommand shift -,
- snap creator framework -,
- tekelec platform distribution 7.4.0,
- tekelec platform distribution 7.7.1,
- tomcat,
- tomcat 9.0.0,
- ubuntu linux 16.04
References
Advisory
Miscellaneous
