UpHeron
All vulnerabilities

Servers and applications

CVE-2016-6797

The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had…

Severity
High 7.5
Published
10 Aug 2017
Last changed
8 Oct 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • Version 9.0.0-milestone9
  • Version 9.0.0-milestone8
  • Version 9.0.0-milestone7
  • Version 9.0.0-milestone6
All 13 release lines
  • From 6.0.0 up to 6.0.45
  • From 7.0.0 up to 7.0.70
  • From 8.0 up to 8.0.36
  • From 8.5.0 up to 8.5.4
  • Version 9.0.0-milestone1
  • Version 9.0.0-milestone2
  • Version 9.0.0-milestone3
  • Version 9.0.0-milestone4
  • Version 9.0.0-milestone5
  • Version 9.0.0-milestone6
  • Version 9.0.0-milestone7
  • Version 9.0.0-milestone8
  • Version 9.0.0-milestone9

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2016-6797
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2016-6797