Security Advisory

CVE-2016-8735

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2017-04-06 21:00:00

Last updated 2025-10-21 23:55:42

Assigner apache

CVSS score not scored

State PUBLISHED

Description

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

← Browse all CVEs View on cve.org ↗