Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Apache Tomcat Incorrect Authorization Vulnerability - CVE-2016-6797 - Vulnerability Database
Apache Tomcat

Apache Tomcat Incorrect Authorization Vulnerability - CVE-2016-6797

High
Reference: CVE-2016-6797
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2016-6797
Title: Apache Tomcat Incorrect Authorization Vulnerability
Overview:

The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9 8.5.0 to 8.5.4 8.0.0.RC1 to 8.0.36 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.