apache tomcat CVE-2016-8735 vulnerability in Apache and Other Products
Published on April 6, 2017

product logo product logo product logo product logo product logo product logo
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Known Exploited Vulnerability

This Apache Tomcat Remote Code Execution Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.

The following remediation steps are recommended / required by June 2, 2023: Apply updates per vendor instructions.

Vulnerability Analysis

CVE-2016-8735 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.


Products Associated with CVE-2016-8735

You can be notified by stack.watch whenever vulnerabilities like CVE-2016-8735 are published in these products:

Apache Tomcat
 
Canonical Ubuntu Linux
 
NetApp Snap Creator Framework
 
NetApp Oncommand Insight
 
NetApp Oncommand Shift
 
NetApp 7 Mode Transition Tool
 
Debian Linux
 
Red Hat Jboss Enterprise Web Server
 
Oracle Transportation Management
 
Oracle Hospitality Guest Access
 
Oracle Agile Engineering Data Management
 
Oracle Communications Application Session Controller
 
Oracle Communications Interactive Session Recorder
 
Oracle Agile Plm
 
Oracle Communications Instant Messaging Server
 
Oracle Micros Relate Crm Software
 
Oracle Retail Convenience Fuel Pos Software
 
Oracle Micros Retail Xbri Loss Prevention
 
Oracle Mysql Enterprise Monitor
 
Oracle
 

What versions are vulnerable to CVE-2016-8735?