CVE-2016-6796 (High) detected in multiple libraries - autoclosed

[mend-for-jackfan.us.kg]

CVE-2016-6796 - High Severity Vulnerability

Vulnerable Libraries - tomcat-jasper-7.0.20.jar, tomcat-catalina-8.0.14.jar, tomcat-embed-jasper-7.0.37.jar

tomcat-jasper-7.0.20.jar

Tomcats JSP Parser

Path to dependency file: /dd-java-agent/instrumentation/jsp-2.3/jsp-2.3.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.apache.tomcat/tomcat-jasper/7.0.20/ac4d5c47607c4a497c96dc07ecab91e9f247b665/tomcat-jasper-7.0.20.jar

Dependency Hierarchy:

• ❌ tomcat-jasper-7.0.20.jar (Vulnerable Library)

tomcat-catalina-8.0.14.jar

Tomcat Servlet Engine Core Classes and Standard implementations

Path to dependency file: /dd-java-agent/instrumentation/classloading/tomcat-testing/tomcat-testing.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.apache.tomcat/tomcat-catalina/8.0.14/1ab50f40dba33c2f2ec99a160fd00e739f36b24b/tomcat-catalina-8.0.14.jar

Dependency Hierarchy:

• ❌ tomcat-catalina-8.0.14.jar (Vulnerable Library)

tomcat-embed-jasper-7.0.37.jar

Core Tomcat implementation

Path to dependency file: /dd-java-agent/instrumentation/jsp-2.3/jsp-2.3.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-jasper/7.0.37/aeb4fef6e68d8df415e2f7d57dfcdd6dc1a43539/tomcat-embed-jasper-7.0.37.jar

Dependency Hierarchy:

• ❌ tomcat-embed-jasper-7.0.37.jar (Vulnerable Library)

Found in HEAD commit: 2819174635979a19573ec0ce8e3e2b63a3848079

Found in base branch: master

Vulnerability Details

A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.

Publish Date: 2017-08-11

URL: CVE-2016-6796

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6796

Release Date: 2016-10-27

Fix Resolution: 7.0.72

---

⛑️ Automatic Remediation is available for this issue

[mend-for-jackfan.us.kg]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.