Critical · published April 7, 2017
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.
🚨 If your Apache Tomcat is running an outdated version, you're at risk of a mind-blowing remote code execution vulnerability! 🔥 Think of this vulnerability like leaving your window wide open while you’re away. An attacker can sneak in through the exposed JMX ports, using the JmxRemoteLifecycleListener like an unwelcome guest who knows how to bypass your security measures. This means an attacker could take control of your server, potentially accessing sensitive data or executing any commands they choose. Picture them rummaging through your valuable files, changing configurations, or even unleashing havoc on your systems. Absolutely devastating!
Think of this vulnerability like leaving your window wide open while you’re away. An attacker can sneak in through the exposed JMX ports, using the JmxRemoteLifecycleListener like an unwelcome guest who knows how to bypass your security measures. CVE-2016-8735 allows remote code execution due to an unupdated JmxRemoteLifecycleListener in Apache Tomcat versions prior to 6.0.48, 7.0.73, 8.0.39, 8.5.7, and 9.0.0.M12, making it susceptible when JMX ports are accessible.
This means an attacker could take control of your server, potentially accessing sensitive data or executing any commands they choose. Picture them rummaging through your valuable files, changing configurations, or even unleashing havoc on your systems. Absolutely devastating! To safeguard your systems, upgrade to the latest versions: 6.0.48, 7.0.73, 8.0.39, 8.5.7, or 9.0.0.M12. Make sure to secure your JMX ports and restrict access to prevent unauthorized connections. It’s time to tighten that window! You've got this! With a few quick updates, you’ll be on your way to securing your Tomcat environment. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| apache/tomcat | < 6.0.48 | 6.0.48 |
| apache/tomcat | ≥ 7.0.0, < 7.0.73 | 7.0.73 |
| apache/tomcat | ≥ 8.0, < 8.0.39 | 8.0.39 |
| apache/tomcat | ≥ 8.5.0, < 8.5.7 | 8.5.7 |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| netapp/7-mode_transition_tool | all versions | — |
| netapp/oncommand_insight | all versions | — |
| netapp/oncommand_shift | all versions | — |
| netapp/snap_creator_framework | all versions | — |
| debian/debian_linux | all versions | — |
| redhat/jboss_enterprise_web_server | all versions | — |
| oracle/agile_engineering_data_management | all versions | — |
| oracle/agile_engineering_data_management | all versions | — |
| oracle/agile_engineering_data_management | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/communications_application_session_controller | all versions | — |
| oracle/communications_application_session_controller | all versions | — |
| oracle/communications_instant_messaging_server | all versions | — |
| oracle/communications_interactive_session_recorder | all versions | — |
| oracle/communications_interactive_session_recorder | all versions | — |
| oracle/communications_interactive_session_recorder | all versions | — |
| oracle/hospitality_guest_access | all versions | — |
| oracle/hospitality_guest_access | all versions | — |
| oracle/micros_relate_crm_software | all versions | — |
| oracle/micros_relate_crm_software | all versions | — |
| oracle/micros_retail_xbri_loss_prevention | all versions | — |
| oracle/micros_retail_xbri_loss_prevention | all versions | — |
| oracle/micros_retail_xbri_loss_prevention | all versions | — |
| oracle/micros_retail_xbri_loss_prevention | all versions | — |
| oracle/micros_retail_xbri_loss_prevention | all versions | — |
| oracle/micros_retail_xbri_loss_prevention | all versions | — |
| oracle/mysql_enterprise_monitor | ≤ 3.2.8.2223 | — |
| oracle/mysql_enterprise_monitor | ≥ 3.3.0, ≤ 3.3.4.3247 | — |
| oracle/mysql_enterprise_monitor | ≥ 3.4.0, ≤ 3.4.2.4181 | — |
| oracle/retail_convenience_and_fuel_pos_software | all versions | — |
| oracle/transportation_management | all versions | — |
| oracle/transportation_management | all versions | — |
| oracle/transportation_management | all versions | — |
| oracle/transportation_management | all versions | — |
| oracle/transportation_management | all versions | — |
| oracle/transportation_management | all versions | — |
| oracle/transportation_management | all versions | — |
| oracle/transportation_management | all versions | — |