Apache Tomcat Improper Access Control vulnerability

GHSA-cw54-59pw-4g8c · CVE-2016-8735

Published May 13, 2022 · Modified Oct 22, 2025

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports.
The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

References

9.8 / 10

CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H

Affected Packages

Maven/org.apache.tomcat:tomcat-catalina

Fix 6.0.48, 7.0.73, 8.0.39, 8.5.7, 9.0.0.M12

Introduced 0, 7.0.0, 8.0.0, 8.5.0, 9.0.0.M1

90 affected versions

7.0.07.0.117.0.127.0.147.0.167.0.197.0.27.0.207.0.217.0.227.0.237.0.257.0.267.0.277.0.287.0.297.0.307.0.327.0.337.0.34 +70 more

Maven/org.apache.tomcat:tomcat-catalina-jmx-remote

Fix 6.0.48, 7.0.73, 8.0.39, 8.5.7, 9.0.0.M12

Introduced 0, 7.0.0, 8.0.0, 8.5.0, 9.0.0.M1

98 affected versions

6.0.366.0.376.0.396.0.416.0.436.0.446.0.456.0.477.0.07.0.117.0.127.0.147.0.167.0.197.0.27.0.207.0.217.0.227.0.237.0.25 +78 more

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes

Apache Tomcat Improper Access Control vulnerability

Description

References

More Maven vulnerabilities

Start Securing