ΠΠΏΠΈΡΠ°Π½ΠΈΠ΅
The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.
A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service.
ΠΠ°ΡΡΠΎΠ½ΡΡΡΠ΅ ΠΏΠ°ΠΊΠ΅ΡΡ
| ΠΠ»Π°ΡΡΠΎΡΠΌΠ° | ΠΠ°ΠΊΠ΅Ρ | Π‘ΠΎΡΡΠΎΡΠ½ΠΈΠ΅ | Π Π΅ΠΊΠΎΠΌΠ΅Π½Π΄Π°ΡΠΈΡ | Π Π΅Π»ΠΈΠ· |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | tomcat6 | Not affected | ||
| Red Hat JBoss BRMS 5 | jbossweb | Will not fix | ||
| Red Hat JBoss Data Grid 6 | jbossweb | Affected | ||
| Red Hat JBoss Enterprise Application Platform 4 | jbossweb | Will not fix | ||
| Red Hat JBoss Enterprise Application Platform 5 | jbossweb | Will not fix | ||
| Red Hat JBoss Enterprise Application Platform 6 | jbossweb | Will not fix | ||
| Red Hat JBoss Fuse Service Works 6 | jbossweb | Will not fix | ||
| Red Hat JBoss Operations Network 3 | jbossweb | Affected | ||
| Red Hat JBoss Portal 6 | jbossweb | Affected | ||
| Red Hat Enterprise Linux 7 | tomcat | Fixed | RHSA-2016:2599 | 03.11.2016 |
ΠΠΎΠΊΠ°Π·ΡΠ²Π°ΡΡ ΠΏΠΎ
Π‘ΡΡΠ»ΠΊΠΈ Π½Π° ΠΈΡΡΠΎΡΠ½ΠΈΠΊΠΈ
ΠΠΎΠΏΠΎΠ»Π½ΠΈΡΠ΅Π»ΡΠ½Π°Ρ ΠΈΠ½ΡΠΎΡΠΌΠ°ΡΠΈΡ
Π‘ΡΠ°ΡΡΡ:
6.3 Medium
CVSS3
4.3 Medium
CVSS2
Π‘Π²ΡΠ·Π°Π½Π½ΡΠ΅ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠΈ
The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.
The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.
The setGlobalContext method in org/apache/naming/factory/ResourceLinkF ...
Improper Verification of Source of a Communication Channel in Apache Tomcat
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ ΡΠ΅ΡΠ²Π΅ΡΠ° ΠΏΡΠΈΠ»ΠΎΠΆΠ΅Π½ΠΈΠΉ Apache Tomcat, ΠΏΠΎΠ·Π²ΠΎΠ»ΡΡΡΠ°Ρ Π½Π°ΡΡΡΠΈΡΠ΅Π»Ρ Π²ΡΠ·Π²Π°ΡΡ ΠΎΡΠΊΠ°Π· Π² ΠΎΠ±ΡΠ»ΡΠΆΠΈΠ²Π°Π½ΠΈΠΈ
6.3 Medium
CVSS3
4.3 Medium
CVSS2