THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2016-8735 (CRITICAL 9.8) — Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated

[NVD] CVE-2016-8735 (CRITICAL 9.8) — Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated

lownvdPublished 2017-04-06

CVE-2016-8735 CVSS: 9.8 CRITICAL Published: 2017-04-06T21:59:00.243

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch

Indicators of compromise

CVE-2016-8735cve
CVE-2016-3427cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2016-8735