جزئیات آسیب‌پذیری
CVE-2016-8735
بهره‌برداری فعال
Apache Software Foundation Apache Tomcat
CVSS 3.1
9.8بحرانی
نمای کلی
اکسپلویت‌های عمومی
اخبار مرتبط
خط زمانی
خلاصه‌ی فارسی
خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.
شرح رسمی (انگلیسی)
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 9.8بحرانی | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Apache Software Foundation | Apache Tomcat | 7.x before 7.0.73 | CVEProject cvelistV5 (CNA) |
| Apache Software Foundation | Apache Tomcat | 8.5.x before 8.5.7 | CVEProject cvelistV5 (CNA) |
| Apache Software Foundation | Apache Tomcat | 8.x before 8.0.39 | CVEProject cvelistV5 (CNA) |
| Apache Software Foundation | Apache Tomcat | 9.x before 9.0.0.M12 | CVEProject cvelistV5 (CNA) |
| Apache Software Foundation | Apache Tomcat | before 6.0.48 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۳۷- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html x_refsource_CONFIRM
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html x_refsource_CONFIRM
- http://svn.apache.org/viewvc?view=revision&revision=1767676 x_refsource_CONFIRM
- http://tomcat.apache.org/security-9.html x_refsource_CONFIRM
- http://www.securitytracker.com/id/1037331 vdb-entryx_refsource_SECTRACK
- http://www.securityfocus.com/bid/94463 vdb-entryx_refsource_BID
- http://www.debian.org/security/2016/dsa-3738 vendor-advisoryx_refsource_DEBIAN
- http://tomcat.apache.org/security-7.html x_refsource_CONFIRM
- http://svn.apache.org/viewvc?view=revision&revision=1767644 x_refsource_CONFIRM
- http://tomcat.apache.org/security-8.html x_refsource_CONFIRM
- http://svn.apache.org/viewvc?view=revision&revision=1767656 x_refsource_CONFIRM
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html x_refsource_CONFIRM
- https://security.netapp.com/advisory/ntap-20180607-0001/ x_refsource_CONFIRM
- http://tomcat.apache.org/security-6.html x_refsource_CONFIRM
- http://rhn.redhat.com/errata/RHSA-2017-0457.html vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2017:0455 vendor-advisoryx_refsource_REDHAT
- http://svn.apache.org/viewvc?view=revision&revision=1767684 x_refsource_CONFIRM
- https://access.redhat.com/errata/RHSA-2017:0456 vendor-advisoryx_refsource_REDHAT
- http://seclists.org/oss-sec/2016/q4/502 x_refsource_CONFIRM
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html x_refsource_MISC
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html x_refsource_MISC
- https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://usn.ubuntu.com/4557-1/ vendor-advisoryx_refsource_UBUNTU
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-8735 government-resource
اطلاعات
- تاریخ انتشار
- ۱۳۹۶/۰۱/۱۸
- آخرین به‌روزرسانی
- ۱۴۰۴/۰۷/۳۰
- وضعیت
- PUBLISHED
- صادرکننده (CNA)
- apache
- اولویت کلون
- به‌زودی
فهرست KEV آژانس CISA
- تاریخ افزوده‌شدن
- ۱۴۰۲/۰۲/۲۲
- مهلت رفع
- ۱۴۰۲/۰۳/۱۲
- استفاده در باج‌افزار
- نامشخص
پیش‌بینی بهره‌برداری (EPSS)
۹۰٫۳۳٪
احتمال بهره‌برداری در ۳۰ روز
۹۹٫۷٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- Automatable
- yes
- Exploitation
- active
- Technical Impact
- total
ضعف‌ها (CWE)
- —