~ / search / GHSA-4c43-cwvx-9crh

GHSA-4c43-cwvx-9crh

Improper Access Control in Apache Tomcat

Source: GitHub Advisory Database (reviewed) Moderate CVE-2014-7810

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.tomcat:tomcat >= 6.0.0, < 6.0.44 6.0.44
Maven org.apache.tomcat:tomcat >= 7.0.0, < 7.0.58 7.0.58
Maven org.apache.tomcat:tomcat >= 8.0.0, < 8.0.16 8.0.16

Details

As written in the advisory (Markdown source, shown as plain text).

The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.

References

External links from the advisory. They lead to third-party sites.