Security Advisory

CVE-2016-0763

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2016-02-25 01:00:00

Last updated 2024-08-05 22:30:04

Assigner redhat

CVSS score not scored

State PUBLISHED

Description

The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.

← Browse all CVEs View on cve.org ↗