NetSight
IP …
medium6.3

CVE-2016-0763

Improper Verification of Source of a Communication Channel in Apache Tomcat

Impact

The `setGlobalContext` method in `org/apache/naming/factory/ResourceLinkFactory.java` in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.tomcat:tomcat>= 7.0.0, < 7.0.687.0.68

Affected products

VendorProductAffected versions
DebianDebian Linux
Versions 7.0, 8.0
ApacheTomcat
Versions 7.0.0, 7.0.2, 7.0.4, 7.0.5, 7.0.6, 7.0.10
CanonicalUbuntu Linux
Versions 12.04, 14.04, 15.10, 16.04

Weakness classification

CWE-264CWE-940

References