CVE-2016-0714 in Oracle Communications

Summary

The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.

Reservation

12/16/2015

Disclosure

02/23/2016

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
121571	Oracle Communications Policy Management access control	264	Not defined	Official fix	CVE-2016-0714
108066	Oracle Management Pack for GoldenGate Apache Tomcat access control	264	Not defined	Official fix	CVE-2016-0714
99969	Oracle WebCenter Sites Apache Tomcat access control	264	Not defined	Official fix	CVE-2016-0714
95706	Oracle MySQL Enterprise Monitor Monitoring access control	264	Not defined	Official fix	CVE-2016-0714
92986	Oracle Virtual Desktop Infrastructure Apache Tomcat access control	264	Not defined	Official fix	CVE-2016-0714
92968	Oracle Transportation Management Install access control	264	Not defined	Official fix	CVE-2016-0714
81080	Apache Tomcat Session Persistence access control	264	Unproven	Official fix	CVE-2016-0714