apache tomcat CVE-2016-8735 is a vulnerability in Apache Tomcat
Published on April 6, 2017

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Known Exploited Vulnerability

This Apache Tomcat Remote Code Execution Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.

The following remediation steps are recommended / required by June 2, 2023: Apply updates per vendor instructions.

Vulnerability Analysis

CVE-2016-8735 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

What is an Authorization Vulnerability?

The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CVE-2016-8735 has been classified to as an Authorization vulnerability or weakness.


Products Associated with CVE-2016-8735

You can be notified by stack.watch whenever vulnerabilities like CVE-2016-8735 are published in these products:

Apache Tomcat
 

What versions of Tomcat are vulnerable to CVE-2016-8735?