What’s Vulnerable › Vulnerabilities

CVE-2016-6794

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-08-10 · updated 2026-10-15

Description

When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.

Affected products

• Apache Tomcat: from 6.0.0 through 6.0.45; from 7.0.0 through 7.0.70; from 8.0 through 8.0.36; from 8.5.0 through 8.5.4; 9.0.0-milestone1, 9.0.0-milestone2, 9.0.0-milestone3, 9.0.0-milestone4, 9.0.0-milestone5, 9.0.0-milestone6 (+3)
• Canonical Ubuntu Linux: 16.04
• Debian Linux: 8.0
• OnCommand Insight: all versions
• NetApp Oncommand Shift: all versions
• NetApp Snap Creator Framework: all versions
• Oracle Tekelec Platform Distribution: from 7.4.0 through 7.7.1
• RedHat Enterprise Linux Desktop: 7.0
• RedHat Enterprise Linux Eus: 7.4, 7.5, 7.6, 7.7
• RedHat Enterprise Linux Server: 7.0
• RedHat Enterprise Linux Server Aus: 7.6, 7.7
• RedHat Enterprise Linux Server Tus: 7.6, 7.7
• RedHat Enterprise Linux Workstation: 7.0
• Red Hat JBoss Enterprise Web Server: 3.0.0

References

• http://rhn.redhat.com/errata/RHSA-2017-0457.html
• http://www.debian.org/security/2016/dsa-3720
• http://www.securityfocus.com/bid/93943
• http://www.securitytracker.com/id/1037143
• https://access.redhat.com/errata/RHSA-2017:0455
• https://access.redhat.com/errata/RHSA-2017:0456
• https://access.redhat.com/errata/RHSA-2017:2247
• https://lists.apache.org/thread.html/09d2f2c65ac4ff5da42f15dc2b0f78b655e50f1a42e8a9784134a9eb%40%3Cannounce.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E

Get alerted when CVE-2016-6794 or the next vulnerability affects your stack