CVE-2016-5018

CRITICAL9.1EPSS 0.94%

Authentication Bypass Using an Alternate Path or Channel in Apache Tomcat

發布日:2022/5/13修改日:2024/4/18
也稱為:GHSA-4v3g-g84w-hv7r

描述

In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.

受影響套件(3)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1CRITICAL9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

參考連結(49)