| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.tomcat:tomcat | ≥ 6.0.0, < 6.0.46≥ 7.0.0, < 7.0.71≥ 8.0.0.RC1, < 8.0.37≥ 8.5.0, < 8.5.5≥ 9.0.0.M1, < 9.0.0.M10 | 6.0.467.0.718.0.378.5.59.0.0.M10 |
| tomcat | = 9.0.0≥ 6.0.0, ≤ 6.0.45≥ 7.0.0, ≤ 7.0.70≥ 8.0, ≤ 8.0.36≥ 8.5.0, ≤ 8.5.4 | |
| tekelec platform distribution | = 7.4.0= 7.7.1 | |
| jboss enterprise application platform | = 6.4 | |
| jboss enterprise web server | = 3.0.0 |
A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free