CVE-2016-8735
CriticalActively exploited (CISA KEV)
Description
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Apache Tomcat
PublishedApr 6, 2017
First seenApr 6, 2017
Added to KEVMay 12, 2023
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: Jun 2, 2023Update
- apache tomcat6.0.48, 7.0.73, 8.0.39, 8.5.7 or later
- org.apache.tomcat:tomcat-catalina-jmx-remote6.0.48, 7.0.73, 8.0.39, 8.5.7, 9.0.0.M12 or later
- org.apache.tomcat:tomcat-catalina6.0.48, 7.0.73, 8.0.39, 8.5.7, 9.0.0.M12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache tomcat | v < 6.0.48, 7.0.0 ≤ v < 7.0.73, 8.0 ≤ v < 8.0.39, 8.5.0 ≤ v < 8.5.7, 9.0.0 | 6.0.48, 7.0.73, 8.0.39, 8.5.7 |
| canonical ubuntu_linux | 16.04 | — |
| netapp 7-mode_transition_tool | No range specified | — |
| netapp oncommand_insight | No range specified | — |
| netapp oncommand_shift | No range specified | — |
| netapp snap_creator_framework | No range specified | — |
| debian debian_linux | 8.0 | — |
| redhat jboss_enterprise_web_server | 3.0.0 | — |
| oracle agile_engineering_data_management | 6.1.3, 6.2.0, 6.2.1.0 | — |
| oracle agile_product_lifecycle_management | 9.3.5, 9.3.6 | — |
| oracle communications_application_session_controller | 3.7.1, 3.8.0 | — |
| oracle communications_instant_messaging_server | 10.0.1 | — |
| oracle communications_interactive_session_recorder | 6.0, 6.1, 6.2 | — |
| oracle hospitality_guest_access | 4.2.0, 4.2.1 | — |
| oracle micros_relate_crm_software | 10.8, 11.4 | — |
| oracle micros_retail_xbri_loss_prevention | 10.0.1, 10.5.0, 10.6.0, 10.7.7, 10.8.0, 10.8.1 | — |
| oracle mysql_enterprise_monitor | v ≤ 3.2.8.2223, 3.3.0 ≤ v ≤ 3.3.4.3247, 3.4.0 ≤ v ≤ 3.4.2.4181 | — |
| oracle retail_convenience_and_fuel_pos_software | 2.1.132 | — |
| oracle transportation_management | 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7 | — |
| org.apache.tomcat:tomcat-catalina-jmx-remoteMaven | v < 6.0.48, 7.0.0 ≤ v < 7.0.73, 8.0.0 ≤ v < 8.0.39, 8.5.0 ≤ v < 8.5.7, 9.0.0.M1 ≤ v < 9.0.0.M12 | 6.0.48, 7.0.73, 8.0.39, 8.5.7, 9.0.0.M12 |
| org.apache.tomcat:tomcat-catalinaMaven | v < 6.0.48, 7.0.0 ≤ v < 7.0.73, 8.0.0 ≤ v < 8.0.39, 8.5.0 ≤ v < 8.5.7, 9.0.0.M1 ≤ v < 9.0.0.M12 | 6.0.48, 7.0.73, 8.0.39, 8.5.7, 9.0.0.M12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.