Critical severity9.1NVD Advisory· Published Aug 10, 2017· Updated May 13, 2026

CVE-2016-5018

Description

In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.apache.tomcat:tomcat-jasperMaven	>= 9.0.0.M1, < 9.0.0.M10	9.0.0.M10
org.apache.tomcat:tomcat-jasperMaven	>= 8.5.0, < 8.5.5	8.5.5
org.apache.tomcat:tomcat-jasperMaven	>= 8.0.0RC1, < 8.0.37	8.0.37
org.apache.tomcat:tomcat-jasperMaven	>= 7.0.0, < 7.0.72	7.0.72
org.apache.tomcat:jasperMaven	>= 6.0.0, < 6.0.47	6.0.47
org.apache.tomcat.embed:tomcat-embed-jasperMaven	>= 9.0.0.M1, < 9.0.0.M10	9.0.0.M10
org.apache.tomcat.embed:tomcat-embed-jasperMaven	>= 8.5.0, < 8.5.5	8.5.5
org.apache.tomcat.embed:tomcat-embed-jasperMaven	>= 8.0.0RC1, < 8.0.37	8.0.37
org.apache.tomcat.embed:tomcat-embed-jasperMaven	>= 7.0.0, < 7.0.72	7.0.72
org.apache.tomcat.embed:tomcat-embed-jasperMaven	>= 6.0.0, < 6.0.47	6.0.47

Affected products

Apache Software Foundation/Apache Tomcatv5
Range: 9.0.0.M1 to 9.0.0.M9

Patches

890a2f681ed2

Remove unnecessary code

https://github.com/apache/tomcatMark ThomasAug 2, 2016via ghsa

commit

1 file changed · +1 −58

java/org/apache/jasper/runtime/JspRuntimeLibrary.java+1 −58 modified

@@ -14,7 +14,6 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-
 package org.apache.jasper.runtime;
 
 import java.beans.PropertyEditor;
@@ -23,9 +22,6 @@
 import java.io.IOException;
 import java.io.OutputStreamWriter;
 import java.lang.reflect.Method;
-import java.security.AccessController;
-import java.security.PrivilegedActionException;
-import java.security.PrivilegedExceptionAction;
 import java.util.Enumeration;
 
 import javax.servlet.RequestDispatcher;
@@ -37,7 +33,6 @@
 import javax.servlet.jsp.PageContext;
 import javax.servlet.jsp.tagext.BodyContent;
 
-import org.apache.jasper.Constants;
 import org.apache.jasper.JasperException;
 import org.apache.jasper.compiler.Localizer;
 import org.apache.jasper.util.ExceptionUtils;
@@ -56,36 +51,6 @@
  */
 public class JspRuntimeLibrary {
     
-    protected static class PrivilegedIntrospectHelper
-        implements PrivilegedExceptionAction<Void> {
-
-        private Object bean;
-        private String prop;
-        private String value;
-        private ServletRequest request;
-        private String param;
-        private boolean ignoreMethodNF;
-
-        PrivilegedIntrospectHelper(Object bean, String prop,
-                                   String value, ServletRequest request,
-                                   String param, boolean ignoreMethodNF)
-        {
-            this.bean = bean;
-            this.prop = prop;
-            this.value = value;
-            this.request = request;
-            this.param = param;
-            this.ignoreMethodNF = ignoreMethodNF;
-        }
-         
-        @Override
-        public Void run() throws JasperException {
-            internalIntrospecthelper(
-                bean,prop,value,request,param,ignoreMethodNF);
-            return null;
-        }
-    }
-
     /**
      * Returns the value of the javax.servlet.error.exception request
      * attribute value, if present, otherwise the value of the
@@ -290,29 +255,7 @@ public static void introspect(Object bean, ServletRequest request)
     public static void introspecthelper(Object bean, String prop,
                                         String value, ServletRequest request,
                                         String param, boolean ignoreMethodNF)
-                                        throws JasperException
-    {
-        if( Constants.IS_SECURITY_ENABLED ) {
-            try {
-                PrivilegedIntrospectHelper dp =
-                    new PrivilegedIntrospectHelper(
-                        bean,prop,value,request,param,ignoreMethodNF);
-                AccessController.doPrivileged(dp);
-            } catch( PrivilegedActionException pe) {
-                Exception e = pe.getException();
-                throw (JasperException)e;
-            }
-        } else {
-            internalIntrospecthelper(
-                bean,prop,value,request,param,ignoreMethodNF);
-        }
-    }
-
-    private static void internalIntrospecthelper(Object bean, String prop,
-                                        String value, ServletRequest request,
-                                        String param, boolean ignoreMethodNF) 
-                                        throws JasperException
-    {
+                                        throws JasperException {
         Method method = null;
         Class<?> type = null;
         Class<?> propertyEditorClass = null;

648122fef84d

Remove unnecessary code

https://github.com/apache/tomcatMark ThomasAug 2, 2016via ghsa

commit

1 file changed · +1 −58

java/org/apache/jasper/runtime/JspRuntimeLibrary.java+1 −58 modified

@@ -14,7 +14,6 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-
 package org.apache.jasper.runtime;
 
 import java.beans.PropertyEditor;
@@ -23,9 +22,6 @@
 import java.io.IOException;
 import java.io.OutputStreamWriter;
 import java.lang.reflect.Method;
-import java.security.AccessController;
-import java.security.PrivilegedActionException;
-import java.security.PrivilegedExceptionAction;
 import java.util.Enumeration;
 
 import javax.servlet.RequestDispatcher;
@@ -37,7 +33,6 @@
 import javax.servlet.jsp.PageContext;
 import javax.servlet.jsp.tagext.BodyContent;
 
-import org.apache.jasper.Constants;
 import org.apache.jasper.JasperException;
 import org.apache.jasper.compiler.Localizer;
 import org.apache.jasper.util.ExceptionUtils;
@@ -56,36 +51,6 @@
  */
 public class JspRuntimeLibrary {
 
-    protected static class PrivilegedIntrospectHelper
-        implements PrivilegedExceptionAction<Void> {
-
-        private final Object bean;
-        private final String prop;
-        private final String value;
-        private final ServletRequest request;
-        private final String param;
-        private final boolean ignoreMethodNF;
-
-        PrivilegedIntrospectHelper(Object bean, String prop,
-                                   String value, ServletRequest request,
-                                   String param, boolean ignoreMethodNF)
-        {
-            this.bean = bean;
-            this.prop = prop;
-            this.value = value;
-            this.request = request;
-            this.param = param;
-            this.ignoreMethodNF = ignoreMethodNF;
-        }
-
-        @Override
-        public Void run() throws JasperException {
-            internalIntrospecthelper(
-                bean,prop,value,request,param,ignoreMethodNF);
-            return null;
-        }
-    }
-
     /**
      * Returns the value of the javax.servlet.error.exception request
      * attribute value, if present, otherwise the value of the
@@ -294,29 +259,7 @@ public static void introspect(Object bean, ServletRequest request)
     public static void introspecthelper(Object bean, String prop,
                                         String value, ServletRequest request,
                                         String param, boolean ignoreMethodNF)
-                                        throws JasperException
-    {
-        if( Constants.IS_SECURITY_ENABLED ) {
-            try {
-                PrivilegedIntrospectHelper dp =
-                    new PrivilegedIntrospectHelper(
-                        bean,prop,value,request,param,ignoreMethodNF);
-                AccessController.doPrivileged(dp);
-            } catch( PrivilegedActionException pe) {
-                Exception e = pe.getException();
-                throw (JasperException)e;
-            }
-        } else {
-            internalIntrospecthelper(
-                bean,prop,value,request,param,ignoreMethodNF);
-        }
-    }
-
-    private static void internalIntrospecthelper(Object bean, String prop,
-                                        String value, ServletRequest request,
-                                        String param, boolean ignoreMethodNF)
-                                        throws JasperException
-    {
+                                        throws JasperException {
         Method method = null;
         Class<?> type = null;
         Class<?> propertyEditorClass = null;

a6b1ebc246b9

Remove unnecessary code

https://github.com/apache/tomcatMark ThomasAug 1, 2016via ghsa

commit

1 file changed · +1 −58

java/org/apache/jasper/runtime/JspRuntimeLibrary.java+1 −58 modified

@@ -14,7 +14,6 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-
 package org.apache.jasper.runtime;
 
 import java.beans.PropertyEditor;
@@ -23,9 +22,6 @@
 import java.io.IOException;
 import java.io.OutputStreamWriter;
 import java.lang.reflect.Method;
-import java.security.AccessController;
-import java.security.PrivilegedActionException;
-import java.security.PrivilegedExceptionAction;
 import java.util.Enumeration;
 
 import javax.servlet.RequestDispatcher;
@@ -37,7 +33,6 @@
 import javax.servlet.jsp.PageContext;
 import javax.servlet.jsp.tagext.BodyContent;
 
-import org.apache.jasper.Constants;
 import org.apache.jasper.JasperException;
 import org.apache.jasper.compiler.Localizer;
 import org.apache.jasper.util.ExceptionUtils;
@@ -56,36 +51,6 @@
  */
 public class JspRuntimeLibrary {
 
-    protected static class PrivilegedIntrospectHelper
-        implements PrivilegedExceptionAction<Void> {
-
-        private final Object bean;
-        private final String prop;
-        private final String value;
-        private final ServletRequest request;
-        private final String param;
-        private final boolean ignoreMethodNF;
-
-        PrivilegedIntrospectHelper(Object bean, String prop,
-                                   String value, ServletRequest request,
-                                   String param, boolean ignoreMethodNF)
-        {
-            this.bean = bean;
-            this.prop = prop;
-            this.value = value;
-            this.request = request;
-            this.param = param;
-            this.ignoreMethodNF = ignoreMethodNF;
-        }
-
-        @Override
-        public Void run() throws JasperException {
-            internalIntrospecthelper(
-                bean,prop,value,request,param,ignoreMethodNF);
-            return null;
-        }
-    }
-
     /**
      * Returns the value of the javax.servlet.error.exception request
      * attribute value, if present, otherwise the value of the
@@ -294,29 +259,7 @@ public static void introspect(Object bean, ServletRequest request)
     public static void introspecthelper(Object bean, String prop,
                                         String value, ServletRequest request,
                                         String param, boolean ignoreMethodNF)
-                                        throws JasperException
-    {
-        if( Constants.IS_SECURITY_ENABLED ) {
-            try {
-                PrivilegedIntrospectHelper dp =
-                    new PrivilegedIntrospectHelper(
-                        bean,prop,value,request,param,ignoreMethodNF);
-                AccessController.doPrivileged(dp);
-            } catch( PrivilegedActionException pe) {
-                Exception e = pe.getException();
-                throw (JasperException)e;
-            }
-        } else {
-            internalIntrospecthelper(
-                bean,prop,value,request,param,ignoreMethodNF);
-        }
-    }
-
-    private static void internalIntrospecthelper(Object bean, String prop,
-                                        String value, ServletRequest request,
-                                        String param, boolean ignoreMethodNF)
-                                        throws JasperException
-    {
+                                        throws JasperException {
         Method method = null;
         Class<?> type = null;
         Class<?> propertyEditorClass = null;

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

News mentions

No linked articles in our index yet.

cvss	0.591
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000