High · published August 11, 2017
A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.
| Product | Versions | Fixed in |
|---|---|---|
| apache/tomcat | ≥ 6.0.0, ≤ 6.0.45 | — |
| apache/tomcat | ≥ 7.0.0, ≤ 7.0.70 | — |
| apache/tomcat | ≥ 8.0, ≤ 8.0.36 | — |
| apache/tomcat | ≥ 8.5.0, ≤ 8.5.4 | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| debian/debian_linux | all versions | — |
| netapp/oncommand_insight | all versions | — |
| netapp/oncommand_shift | all versions | — |
| netapp/snap_creator_framework | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| oracle/tekelec_platform_distribution | all versions | — |
| oracle/tekelec_platform_distribution | all versions | — |
| redhat/jboss_enterprise_application_platform | all versions | — |
| redhat/jboss_enterprise_web_server | all versions | — |
| redhat/enterprise_linux_desktop | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_server | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_workstation | all versions | — |