CVE-2016-8735: apache tomcat +18 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2016-8735

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 90,3%

Kerentanan pada apache tomcat, canonical ubuntu linux +17 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 12 Mei 2023, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

Rincian

Terbit di NVD: 6 April 2017
Terakhir diubah: 25 Agustus 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
EPSS (30 hari): 90,3% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Apache Tomcat Remote Code Execution Vulnerability
Masuk KEV: 12 Mei 2023
Tenggat CISA: 2 Juni 2023 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
apache	tomcat	Semua versi sebelum 6.0.48
apache	tomcat	Versi 7.0.0 hingga sebelum 7.0.73
apache	tomcat	Versi 8.0 hingga sebelum 8.0.39
apache	tomcat	Versi 8.5.0 hingga sebelum 8.5.7
apache	tomcat	Versi 9.0.0
apache	tomcat	Versi 9.0.0 milestone1
apache	tomcat	Versi 9.0.0 milestone10
apache	tomcat	Versi 9.0.0 milestone11
apache	tomcat	Versi 9.0.0 milestone2
apache	tomcat	Versi 9.0.0 milestone3
apache	tomcat	Versi 9.0.0 milestone4
apache	tomcat	Versi 9.0.0 milestone5
apache	tomcat	Versi 9.0.0 milestone6
apache	tomcat	Versi 9.0.0 milestone7
apache	tomcat	Versi 9.0.0 milestone8
apache	tomcat	Versi 9.0.0 milestone9
canonical	ubuntu linux	Versi 16.04
netapp	7-mode transition tool	Semua versi
netapp	oncommand insight	Semua versi
netapp	oncommand shift	Semua versi
netapp	snap creator framework	Semua versi
debian	debian linux	Versi 8.0
redhat	jboss enterprise web server	Versi 3.0.0
oracle	agile engineering data management	Versi 6.1.3
oracle	agile engineering data management	Versi 6.2.0
oracle	agile engineering data management	Versi 6.2.1.0
oracle	agile product lifecycle management	Versi 9.3.5
oracle	agile product lifecycle management	Versi 9.3.6
oracle	communications application session controller	Versi 3.7.1
oracle	communications application session controller	Versi 3.8.0
oracle	communications instant messaging server	Versi 10.0.1
oracle	communications interactive session recorder	Versi 6.0
oracle	communications interactive session recorder	Versi 6.1
oracle	communications interactive session recorder	Versi 6.2
oracle	hospitality guest access	Versi 4.2.0
oracle	hospitality guest access	Versi 4.2.1
oracle	micros relate crm software	Versi 10.8
oracle	micros relate crm software	Versi 11.4
oracle	micros retail xbri loss prevention	Versi 10.0.1
oracle	micros retail xbri loss prevention	Versi 10.5.0
oracle	micros retail xbri loss prevention	Versi 10.6.0
oracle	micros retail xbri loss prevention	Versi 10.7.7
oracle	micros retail xbri loss prevention	Versi 10.8.0
oracle	micros retail xbri loss prevention	Versi 10.8.1
oracle	mysql enterprise monitor	Semua versi hingga 3.2.8.2223
oracle	mysql enterprise monitor	Versi 3.3.0 hingga 3.3.4.3247
oracle	mysql enterprise monitor	Versi 3.4.0 hingga 3.4.2.4181
oracle	retail convenience and fuel pos software	Versi 2.1.132
oracle	transportation management	Versi 6.3.0
oracle	transportation management	Versi 6.3.1
oracle	transportation management	Versi 6.3.2
oracle	transportation management	Versi 6.3.3
oracle	transportation management	Versi 6.3.4
oracle	transportation management	Versi 6.3.5
oracle	transportation management	Versi 6.3.6
oracle	transportation management	Versi 6.3.7

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://tomcat.apache.org/security-6.html release notes · advisory vendor
http://tomcat.apache.org/security-7.html release notes · advisory vendor
http://tomcat.apache.org/security-8.html release notes · advisory vendor
http://tomcat.apache.org/security-9.html release notes · advisory vendor
http://svn.apache.org/viewvc?view=revision&revision=1767644 broken link · patch
http://svn.apache.org/viewvc?view=revision&revision=1767656 broken link · patch
http://svn.apache.org/viewvc?view=revision&revision=1767676 broken link · patch
http://svn.apache.org/viewvc?view=revision&revision=1767684 broken link · patch
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html patch · advisory pihak ketiga
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html patch · advisory pihak ketiga
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html patch · advisory pihak ketiga
https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.... mailing list · patch
https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.... mailing list · patch
https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.... mailing list · patch
https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.... mailing list · patch
https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.... mailing list · patch
https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.... mailing list · patch
https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.... mailing list · patch
https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.... mailing list · patch
https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.... mailing list · patch
https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.... mailing list · patch
https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.... mailing list · patch
https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat... mailing list · patch
https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat... mailing list · patch
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat... mailing list · patch

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.