Get a demo
Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Apache Tomcat Permissions Privileges and Access Controls Vulnerability - CVE-2016-0763 - Vulnerability Database
Apache Tomcat

Apache Tomcat Permissions Privileges and Access Controls Vulnerability - CVE-2016-0763

Medium
Reference: CVE-2016-0763
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2016-0763
Title: Apache Tomcat Permissions Privileges and Access Controls Vulnerability
Overview:

The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68 8.x before 8.0.31 and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data or cause a denial of service (application disruption) via a web application that sets a crafted global context.