Apache Tomcat Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 12/05/2023. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.tomcat:tomcat-catalina | ≥ 7.0.0, < 7.0.73≥ 8.0.0, < 8.0.39≥ 8.5.0, < 8.5.7≥ 9.0.0.M1, < 9.0.0.M12< 6.0.48 | 7.0.738.0.398.5.79.0.0.M126.0.48 |
| org.apache.tomcat:tomcat-catalina-jmx-remote | ≥ 7.0.0, < 7.0.73≥ 8.0.0, < 8.0.39≥ 8.5.0, < 8.5.7≥ 9.0.0.M1, < 9.0.0.M12< 6.0.48 | 7.0.738.0.398.5.79.0.0.M126.0.48 |
| tomcat | = 9.0.0≥ 7.0.0, < 7.0.73≥ 8.0, < 8.0.39≥ 8.5.0, < 8.5.7< 6.0.48 | 7.0.738.0.398.5.76.0.48 |
| agile engineering data management | = 6.1.3= 6.2.0= 6.2.1.0 | |
| agile product lifecycle management | = 9.3.5= 9.3.6 | |
| communications application session controller | = 3.7.1= 3.8.0 | |
| communications instant messaging server | = 10.0.1 | |
| communications interactive session recorder | = 6.0= 6.1= 6.2 | |
| hospitality guest access | = 4.2.0= 4.2.1 | |
| micros relate crm software | = 10.8= 11.4 | |
| micros retail xbri loss prevention | = 10.0.1= 10.5.0= 10.6.0= 10.7.7= 10.8.0= 10.8.1 | |
| mysql enterprise monitor | ≥ 3.3.0, ≤ 3.3.4.3247≥ 3.4.0, ≤ 3.4.2.4181≤ 3.2.8.2223 | |
| retail convenience and fuel pos software | = 2.1.132 | |
| transportation management | = 6.3.0= 6.3.1= 6.3.2= 6.3.3= 6.3.4= 6.3.5= 6.3.6= 6.3.7 | |
| jboss enterprise web server | = 3.0.0 |
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free