NetSight
IP …
high7.5

CVE-2016-6797

The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not …

Impact

The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.

Affected products

VendorProductAffected versions
ApacheTomcat
from 6.0.0 through 6.0.45
from 7.0.0 through 7.0.70
from 8.0 through 8.0.36
from 8.5.0 through 8.5.4
Version 9.0.0
OracleTekelec Platform Distribution
from 7.4.0 through 7.7.1
DebianDebian Linux
Version 8.0
NetappOncommand Insight
All versions
NetappOncommand Shift
All versions
NetappSnap Creator Framework
All versions
CanonicalUbuntu Linux
Version 16.04
RedhatJboss Enterprise Web Server
Version 3.0.0
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Eus
Versions 7.4, 7.5, 7.6, 7.7
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Server Aus
Versions 7.4, 7.6, 7.7

Weakness classification

CWE-863

References