Fluid Attacks Database

Description

Improper Access Control in Apache Tomcat The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
maven	org.apache.tomcat:tomcat	>=6.0.0 <6.0.44 \|\| >=7.0.0 <7.0.58 \|\| >=8.0.0 <8.0.16	6.0.44, 7.0.58, 8.0.16
rpm rhel7	tomcat	<0:7.0.54-8.el7_2	0:7.0.54-8.el7_2
rpm rhel6	tomcat6	<0:6.0.24-94.el6_7	0:6.0.24-94.el6_7

Aliases

1. CVE-2014-78102. NVD-2014-78103. OSV-2014-78104. GCVE-2014-7810

References

1. https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c050549642. https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E3. https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E4. https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E5. https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E6. https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E7. https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E8. https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E9. http://marc.info/?l=bugtraq&m=145974991225029&w=210. http://rhn.redhat.com/errata/RHSA-2015-1621.html11. http://rhn.redhat.com/errata/RHSA-2015-1622.html12. http://rhn.redhat.com/errata/RHSA-2016-0492.html13. http://rhn.redhat.com/errata/RHSA-2016-2046.html14. http://svn.apache.org/viewvc?view=revision&revision=164401815. http://svn.apache.org/viewvc?view=revision&revision=164564216. http://tomcat.apache.org/security-6.html17. http://tomcat.apache.org/security-7.html18. http://tomcat.apache.org/security-8.html19. http://www.debian.org/security/2015/dsa-342820. http://www.debian.org/security/2016/dsa-344721. http://www.debian.org/security/2016/dsa-353022. http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html23. http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html24. http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html25. http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html26. http://www.ubuntu.com/usn/USN-2654-127. http://www.ubuntu.com/usn/USN-2655-1

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.