Advisory details:
github_osv / GHSA-jc7p-5r39-9477
| Advisory ID | github_osv/GHSA-jc7p-5r39-9477 |
| Aliases |
CVE-2016-6816
|
| Summary | Improper Input Validation in Apache Tomcat The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 6.4 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| CWE-20 | Improper Input Validation |
| System | Score | Found at |
|---|---|---|
| cvssv3 | 7.1 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-jc7p-5r39-9477/GHSA-jc7p-5r39-9477.json |
| generic_textual | HIGH |
| Data source | Exploit-DB |
|---|---|
| Date added | April 3, 2017 |
| Description | Apache Tomcat 6/7/8/9 - Information Disclosure |
| Ransomware campaign use | Unknown |
| Source publication date | April 4, 2017 |
| Exploit type | remote |
| Platform | multiple |
| Source update date | April 3, 2017 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
There are no SSVC decisions available.