CVE-2016-0706

Severity: medium (CVSS 4.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-02-25 · updated 2026-10-15
Weakness: CWE-200

Description

Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.

Affected products

Apache Tomcat: 6.0.0, 6.0.0-alpha, 6.0.1, 6.0.1-alpha, 6.0.2, 6.0.2-alpha (+92)
Canonical Ubuntu Linux: 12.04, 14.04, 15.10, 16.04
Debian Linux: 7.0, 8.0

References

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html
http://marc.info/?l=bugtraq&m=145974991225029&w=2
http://rhn.redhat.com/errata/RHSA-2016-1089.html
http://rhn.redhat.com/errata/RHSA-2016-2045.html
http://rhn.redhat.com/errata/RHSA-2016-2599.html
http://rhn.redhat.com/errata/RHSA-2016-2807.html
http://rhn.redhat.com/errata/RHSA-2016-2808.html
http://seclists.org/bugtraq/2016/Feb/144
http://svn.apache.org/viewvc?view=revision&revision=1722799

Get alerted when CVE-2016-0706 or the next vulnerability affects your stack