CVE-2016-6816 Improper Input Validation in Apache Tomcat
HighCVSS 7.1
EPSS 39.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.tomcat/tomcat-coyote(Maven) | >= 9.0.0.M1, < 9.0.0.M12 | 9.0.0.M12 |
| org.apache.tomcat/tomcat-coyote(Maven) | = 9.0.0.M1 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 9.0.0.M10 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 9.0.0.M11 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 9.0.0.M3 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 9.0.0.M4 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 9.0.0.M6 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 9.0.0.M8 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 9.0.0.M9 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | >= 8.5.0, < 8.5.8 | 8.5.8 |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.5.0 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.5.2 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.5.3 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.5.4 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.5.5 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.5.6 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | >= 8.0.0RC1, < 8.0.39 | 8.0.39 |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.0-RC1 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.0-RC10 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.0-RC3 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.0-RC5 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.1 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.11 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.12 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.14 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.15 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.17 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.18 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.20 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.21 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.22 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.23 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.24 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.26 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.27 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.28 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.29 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.3 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.30 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.32 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.33 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.35 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.36 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.37 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.38 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.5 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.8 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 8.0.9 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | >= 7.0.0, < 7.0.73 | 7.0.73 |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.0 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.11 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.12 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.14 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.16 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.19 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.2 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.20 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.21 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.22 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.23 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.25 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.26 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.27 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.28 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.29 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.30 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.32 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.33 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.34 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.35 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.37 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.39 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.4 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.40 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.41 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.42 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.47 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.5 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.50 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.52 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.53 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.54 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.55 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.56 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.57 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.59 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.6 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.61 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.62 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.63 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.64 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.65 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.67 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.68 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.69 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.70 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.72 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | = 7.0.8 | No fix listed |
| org.apache.tomcat/tomcat-coyote(Maven) | >= 6.0.0, < 6.0.48 | 6.0.48 |
| org.apache.tomcat/tomcat-coyote(Maven) | >= 9.0.0.M1, <= 9.0.0.M11 | No fix listed |
| apache tomcat | = 6.0.0 | No fix listed |
| apache tomcat | = 6.0.1 | No fix listed |
| apache tomcat | = 6.0.2 | No fix listed |
| apache tomcat | = 6.0.3 | No fix listed |
| apache tomcat | = 6.0.4 | No fix listed |
| apache tomcat | = 6.0.5 | No fix listed |
| apache tomcat | = 6.0.6 | No fix listed |
| apache tomcat | = 6.0.7 | No fix listed |
| apache tomcat | = 6.0.8 | No fix listed |
| apache tomcat | = 6.0.9 | No fix listed |
| apache tomcat | = 6.0.10 | No fix listed |
| apache tomcat | = 6.0.11 | No fix listed |
| apache tomcat | = 6.0.12 | No fix listed |
| apache tomcat | = 6.0.13 | No fix listed |
| apache tomcat | = 6.0.14 | No fix listed |
| apache tomcat | = 6.0.15 | No fix listed |
| apache tomcat | = 6.0.16 | No fix listed |
| apache tomcat | = 6.0.17 | No fix listed |
| apache tomcat | = 6.0.18 | No fix listed |
| apache tomcat | = 6.0.19 | No fix listed |
| apache tomcat | = 6.0.20 | No fix listed |
| apache tomcat | = 6.0.21 | No fix listed |
| apache tomcat | = 6.0.22 | No fix listed |
| apache tomcat | = 6.0.23 | No fix listed |
| apache tomcat | = 6.0.24 | No fix listed |
| apache tomcat | = 6.0.25 | No fix listed |
| apache tomcat | = 6.0.26 | No fix listed |
| apache tomcat | = 6.0.27 | No fix listed |
| apache tomcat | = 6.0.28 | No fix listed |
| apache tomcat | = 6.0.29 | No fix listed |
| apache tomcat | = 6.0.30 | No fix listed |
| apache tomcat | = 6.0.31 | No fix listed |
| apache tomcat | = 6.0.32 | No fix listed |
| apache tomcat | = 6.0.33 | No fix listed |
| apache tomcat | = 6.0.34 | No fix listed |
| apache tomcat | = 6.0.35 | No fix listed |
| apache tomcat | = 6.0.36 | No fix listed |
| apache tomcat | = 6.0.37 | No fix listed |
| apache tomcat | = 6.0.38 | No fix listed |
| apache tomcat | = 6.0.39 | No fix listed |
| apache tomcat | = 6.0.40 | No fix listed |
| apache tomcat | = 6.0.41 | No fix listed |
| apache tomcat | = 6.0.42 | No fix listed |
| apache tomcat | = 6.0.43 | No fix listed |
| apache tomcat | = 6.0.44 | No fix listed |
| apache tomcat | = 6.0.45 | No fix listed |
| apache tomcat | = 6.0.46 | No fix listed |
| apache tomcat | = 6.0.47 | No fix listed |
| apache tomcat | = 7.0.0 | No fix listed |
| apache tomcat | = 7.0.1 | No fix listed |
| apache tomcat | = 7.0.2 | No fix listed |
| apache tomcat | = 7.0.3 | No fix listed |
| apache tomcat | = 7.0.4 | No fix listed |
| apache tomcat | = 7.0.5 | No fix listed |
| apache tomcat | = 7.0.6 | No fix listed |
| apache tomcat | = 7.0.7 | No fix listed |
| apache tomcat | = 7.0.8 | No fix listed |
| apache tomcat | = 7.0.9 | No fix listed |
| apache tomcat | = 7.0.10 | No fix listed |
| apache tomcat | = 7.0.11 | No fix listed |
| apache tomcat | = 7.0.12 | No fix listed |
| apache tomcat | = 7.0.13 | No fix listed |
| apache tomcat | = 7.0.14 | No fix listed |
| apache tomcat | = 7.0.15 | No fix listed |
| apache tomcat | = 7.0.16 | No fix listed |
| apache tomcat | = 7.0.17 | No fix listed |
| apache tomcat | = 7.0.18 | No fix listed |
| apache tomcat | = 7.0.19 | No fix listed |
| apache tomcat | = 7.0.20 | No fix listed |
| apache tomcat | = 7.0.21 | No fix listed |
| apache tomcat | = 7.0.22 | No fix listed |
| apache tomcat | = 7.0.23 | No fix listed |
| apache tomcat | = 7.0.24 | No fix listed |
| apache tomcat | = 7.0.25 | No fix listed |
| apache tomcat | = 7.0.26 | No fix listed |
| apache tomcat | = 7.0.27 | No fix listed |
| apache tomcat | = 7.0.28 | No fix listed |
| apache tomcat | = 7.0.29 | No fix listed |
| apache tomcat | = 7.0.30 | No fix listed |
| apache tomcat | = 7.0.31 | No fix listed |
| apache tomcat | = 7.0.32 | No fix listed |
| apache tomcat | = 7.0.33 | No fix listed |
| apache tomcat | = 7.0.34 | No fix listed |
| apache tomcat | = 7.0.35 | No fix listed |
| apache tomcat | = 7.0.36 | No fix listed |
| apache tomcat | = 7.0.37 | No fix listed |
| apache tomcat | = 7.0.38 | No fix listed |
| apache tomcat | = 7.0.39 | No fix listed |
| apache tomcat | = 7.0.40 | No fix listed |
| apache tomcat | = 7.0.41 | No fix listed |
| apache tomcat | = 7.0.42 | No fix listed |
| apache tomcat | = 7.0.43 | No fix listed |
| apache tomcat | = 7.0.44 | No fix listed |
| apache tomcat | = 7.0.45 | No fix listed |
| apache tomcat | = 7.0.46 | No fix listed |
| apache tomcat | = 7.0.47 | No fix listed |
| apache tomcat | = 7.0.48 | No fix listed |
| apache tomcat | = 7.0.49 | No fix listed |
| apache tomcat | = 7.0.50 | No fix listed |
| apache tomcat | = 7.0.51 | No fix listed |
References
- Debian Security Tracker CVE-2016-6816 vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- RHSA-2017:0455 vendor-advisory
- lists.apache.org
- [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- security.netapp.com
- svn.apache.org
- svn.apache.org
- svn.apache.org
- svn.apache.org
- svn.apache.org
- tomcat.apache.org release-notes vendor-advisory
- tomcat.apache.org release-notes vendor-advisory
- tomcat.apache.org release-notes vendor-advisory
- tomcat.apache.org release-notes vendor-advisory
- USN-4557-1 vendor-advisory
- web.archive.org
- web.archive.org
- 41783 exploit
- RHSA-2017:0456 vendor-advisory
- RHSA-2017:0935 vendor-advisory
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- RHSA-2017:0244 vendor-advisory
- RHSA-2017:0245 vendor-advisory
- RHSA-2017:0246 vendor-advisory
- RHSA-2017:0247 vendor-advisory
- RHSA-2017:0250 vendor-advisory
- RHSA-2017:0457 vendor-advisory
- RHSA-2017:0527 vendor-advisory
- DSA-3738 vendor-advisory
- www.oracle.com
- github.com
- 94461 third-party-advisory vdb-entry
- 1037332 vdb-entry