Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Apache Tomcat Permissions Privileges and Access Controls Vulnerability - CVE-2016-0763 - Vulnerability Database
Apache Tomcat

Apache Tomcat Permissions Privileges and Access Controls Vulnerability - CVE-2016-0763

Medium
Reference: CVE-2016-0763
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2016-0763
Title: Apache Tomcat Permissions Privileges and Access Controls Vulnerability
Overview:

The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68 8.x before 8.0.31 and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data or cause a denial of service (application disruption) via a web application that sets a crafted global context.