NetSight
IP …
medium5.3

CVE-2016-6794

When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager.

Impact

When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.

Affected products

VendorProductAffected versions
ApacheTomcat
from 6.0.0 through 6.0.45
from 7.0.0 through 7.0.70
from 8.0 through 8.0.36
from 8.5.0 through 8.5.4
Version 9.0.0
DebianDebian Linux
Version 8.0
RedhatJboss Enterprise Web Server
Version 3.0.0
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Eus
Versions 7.4, 7.5, 7.6, 7.7
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Server Aus
Versions 7.6, 7.7
RedhatEnterprise Linux Server Tus
Versions 7.6, 7.7
RedhatEnterprise Linux Workstation
Version 7.0
NetappOncommand Insight
All versions
NetappOncommand Shift
All versions
NetappSnap Creator Framework
All versions

References