Описание
A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.
It was discovered that a malicious web application could bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 5 | tomcat5 | Will not fix | ||
| Red Hat Enterprise Linux 6 | tomcat6 | Will not fix | ||
| Red Hat JBoss BRMS 5 | jbossweb | Out of support scope | ||
| Red Hat JBoss Data Grid 6 | jbossweb | Out of support scope | ||
| Red Hat JBoss Data Virtualization 6 | jbossweb | Out of support scope | ||
| Red Hat JBoss Enterprise Application Platform 5 | jbossweb | Out of support scope | ||
| Red Hat JBoss Enterprise Web Server 2 | tomcat6 | Will not fix | ||
| Red Hat JBoss Enterprise Web Server 2 | tomcat7 | Will not fix | ||
| Red Hat JBoss Enterprise Web Server 3 | tomcat7 | Fix deferred | ||
| Red Hat JBoss Enterprise Web Server 3 | tomcat8 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
4.2 Medium
CVSS3
4 Medium
CVSS2
Связанные уязвимости
A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.
A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.
A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0 ...
Apache Tomcat vulnerable to SecurityManager bypass
ELSA-2017-2247: tomcat security, bug fix, and enhancement update (LOW)
4.2 Medium
CVSS3
4 Medium
CVSS2