VYPR
Get started
← All advisories
Critical severity9.8CISA KEVNVD Advisory· Published Apr 6, 2017· Updated Apr 21, 2026

CVE-2016-8735

CVE-2016-8735

Description

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.tomcat:tomcat-catalina-jmx-remoteMaven
< 6.0.486.0.48
org.apache.tomcat:tomcat-catalina-jmx-remoteMaven
>= 7.0.0, < 7.0.737.0.73
org.apache.tomcat:tomcat-catalina-jmx-remoteMaven
>= 8.0.0, < 8.0.398.0.39
org.apache.tomcat:tomcat-catalina-jmx-remoteMaven
>= 8.5.0, < 8.5.78.5.7
org.apache.tomcat:tomcat-catalina-jmx-remoteMaven
>= 9.0.0.M1, < 9.0.0.M129.0.0.M12
org.apache.tomcat:tomcat-catalinaMaven
< 6.0.486.0.48
org.apache.tomcat:tomcat-catalinaMaven
>= 7.0.0, < 7.0.737.0.73
org.apache.tomcat:tomcat-catalinaMaven
>= 8.0.0, < 8.0.398.0.39
org.apache.tomcat:tomcat-catalinaMaven
>= 8.5.0, < 8.5.78.5.7
org.apache.tomcat:tomcat-catalinaMaven
>= 9.0.0.M1, < 9.0.0.M129.0.0.M12

Affected products

51
  • Apache/Tomcat13 versions
    cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*+ 12 more
    • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*range: <6.0.48
    • cpe:2.3:a:apache:tomcat:9.0.0:-:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*
  • NetApp/7 Mode Transition Tool
    cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:*
  • NetApp/Oncommand Insight
    cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
  • NetApp/Oncommand Shift
    cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:*
  • NetApp/Snap Creator Framework
    cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*
  • Oracle Corporation/Agile Engineering Data Management3 versions
    cpe:2.3:a:oracle:agile_engineering_data_management:6.1.3:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:agile_engineering_data_management:6.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:agile_engineering_data_management:6.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*
  • Oracle Corporation/Agile Plm2 versions
    cpe:2.3:a:oracle:agile_plm:9.3.5:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:agile_plm:9.3.5:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
  • Oracle Corporation/Communications Application Session Controller2 versions
    cpe:2.3:a:oracle:communications_application_session_controller:3.7.1:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:communications_application_session_controller:3.7.1:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:communications_application_session_controller:3.8.0:*:*:*:*:*:*:*
  • Oracle Corporation/Communications Instant Messaging Server
    cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1:*:*:*:*:*:*:*
  • Oracle Corporation/Communications Interactive Session Recorder3 versions
    cpe:2.3:a:oracle:communications_interactive_session_recorder:6.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:communications_interactive_session_recorder:6.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:communications_interactive_session_recorder:6.1:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:communications_interactive_session_recorder:6.2:*:*:*:*:*:*:*
  • Oracle Corporation/Hospitality Guest Access2 versions
    cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*
  • Oracle Corporation/Micros Relate Crm Software2 versions
    cpe:2.3:a:oracle:micros_relate_crm_software:10.8:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:micros_relate_crm_software:10.8:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:micros_relate_crm_software:11.4:*:*:*:*:*:*:*
  • Oracle Corporation/Micros Retail Xbri Loss Prevention6 versions
    cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.0.1:*:*:*:*:*:*:*+ 5 more
    • cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.5.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.6.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.7.7:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.8.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.8.1:*:*:*:*:*:*:*
  • Oracle Corporation/Mysql Enterprise Monitor
    cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*
    Range: <=3.2.8.2223
  • Oracle Corporation/Retail Convenience And Fuel Pos Software
    cpe:2.3:a:oracle:retail_convenience_and_fuel_pos_software:2.1.132:*:*:*:*:*:*:*
  • Oracle Corporation/Transportation Management8 versions
    cpe:2.3:a:oracle:transportation_management:6.3.0:*:*:*:*:*:*:*+ 7 more
    • cpe:2.3:a:oracle:transportation_management:6.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:transportation_management:6.3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:transportation_management:6.3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:transportation_management:6.3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:transportation_management:6.3.4:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:transportation_management:6.3.5:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:transportation_management:6.3.6:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:transportation_management:6.3.7:*:*:*:*:*:*:*
  • Red Hat/Jboss Enterprise Web Server
    cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:*
  • Canonical (company)/Ubuntu Linux
    cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
  • Debian/Debian Linux
    cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Patches

6
fe0424f91a9f
https://github.com/apache/tomcatvia osv
b5205c92f41d
https://github.com/apache/tomcatvia osv
7e3a037055cc

Explicitly configure allowed credential types

https://github.com/apache/tomcatMark ThomasNov 2, 2016via ghsa
commit
2 files changed · +9 −1
  • java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java+5 −1 modified
    @@ -264,6 +264,10 @@ public void lifecycleEvent(LifecycleEvent event) {
                 serverCsf = new RmiClientLocalhostSocketFactory(serverCsf);
             }
 
+            env.put("jmx.remote.rmi.server.credential.types", new String[] {
+                    String[].class.getName(),
+                    String.class.getName() });
+
             // Populate the env properties used to create the server
             if (serverCsf != null) {
                 env.put(RMIConnectorServer.RMI_CLIENT_SOCKET_FACTORY_ATTRIBUTE, serverCsf);
@@ -328,7 +332,7 @@ private JMXConnectorServer createServer(String serverName,
             cs = new RMIConnectorServer(serviceUrl, theEnv, server,
                     ManagementFactory.getPlatformMBeanServer());
             cs.start();
-            registry.bind("jmxrmi", server);
+            registry.bind("jmxrmi", server.toStub());
             log.info(sm.getString("jmxRemoteLifecycleListener.start",
                     Integer.toString(theRmiRegistryPort),
                     Integer.toString(theRmiServerPort), serverName));
  • webapps/docs/changelog.xml+4 −0 modified
    @@ -87,6 +87,10 @@
         Correctly test for control characters when reading the provided shutdown
         password. (markt)
       </fix>
+      <fix>
+        When configuring the JMX remote listener, specify the allowed types for
+        the credentials. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">
0f76016a4ec4

Explicitly configure allowed credential types

https://github.com/apache/tomcat80Mark ThomasNov 2, 2016via ghsa
commit
2 files changed · +9 −1
  • java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java+5 −1 modified
    @@ -264,6 +264,10 @@ public void lifecycleEvent(LifecycleEvent event) {
                 serverCsf = new RmiClientLocalhostSocketFactory(serverCsf);
             }
 
+            env.put("jmx.remote.rmi.server.credential.types", new String[] {
+                    String[].class.getName(),
+                    String.class.getName() });
+
             // Populate the env properties used to create the server
             if (serverCsf != null) {
                 env.put(RMIConnectorServer.RMI_CLIENT_SOCKET_FACTORY_ATTRIBUTE, serverCsf);
@@ -328,7 +332,7 @@ private JMXConnectorServer createServer(String serverName,
             cs = new RMIConnectorServer(serviceUrl, theEnv, server,
                     ManagementFactory.getPlatformMBeanServer());
             cs.start();
-            registry.bind("jmxrmi", server);
+            registry.bind("jmxrmi", server.toStub());
             log.info(sm.getString("jmxRemoteLifecycleListener.start",
                     Integer.toString(theRmiRegistryPort),
                     Integer.toString(theRmiServerPort), serverName));
  • webapps/docs/changelog.xml+4 −0 modified
    @@ -71,6 +71,10 @@
         Correctly test for control characters when reading the provided shutdown
         password. (markt)
       </fix>
+      <fix>
+        When configuring the JMX remote listener, specify the allowed types for
+        the credentials. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">
292d6ccdc9ed

Explicitly configure allowed credential types

https://github.com/apache/tomcatMark ThomasNov 2, 2016via ghsa
commit
2 files changed · +9 −1
  • java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java+5 −1 modified
    @@ -264,6 +264,10 @@ public void lifecycleEvent(LifecycleEvent event) {
                 serverCsf = new RmiClientLocalhostSocketFactory(serverCsf);
             }
 
+            env.put("jmx.remote.rmi.server.credential.types", new String[] {
+                    String[].class.getName(),
+                    String.class.getName() });
+
             // Populate the env properties used to create the server
             if (serverCsf != null) {
                 env.put(RMIConnectorServer.RMI_CLIENT_SOCKET_FACTORY_ATTRIBUTE, serverCsf);
@@ -328,7 +332,7 @@ private JMXConnectorServer createServer(String serverName,
             cs = new RMIConnectorServer(serviceUrl, theEnv, server,
                     ManagementFactory.getPlatformMBeanServer());
             cs.start();
-            registry.bind("jmxrmi", server);
+            registry.bind("jmxrmi", server.toStub());
             log.info(sm.getString("jmxRemoteLifecycleListener.start",
                     Integer.toString(theRmiRegistryPort),
                     Integer.toString(theRmiServerPort), serverName));
  • webapps/docs/changelog.xml+4 −0 modified
    @@ -84,6 +84,10 @@
         <code>o.a.catalina.connector.CoyoteInputStream</code>/
         <code>o.a.catalina.connector.CoyoteOutputStream</code>. (violetagg)
       </add>
+      <fix>
+        When configuring the JMX remote listener, specify the allowed types for
+        the credentials. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">
0e83ad3e547f

Explicitly configure allowed credential types

https://github.com/apache/tomcatMark ThomasNov 2, 2016via ghsa
commit
2 files changed · +9 −1
  • java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java+5 −1 modified
    @@ -264,6 +264,10 @@ public void lifecycleEvent(LifecycleEvent event) {
                 serverCsf = new RmiClientLocalhostSocketFactory(serverCsf);
             }
 
+            env.put("jmx.remote.rmi.server.credential.types", new String[] {
+                    String[].class.getName(),
+                    String.class.getName() });
+
             // Populate the env properties used to create the server
             if (serverCsf != null) {
                 env.put(RMIConnectorServer.RMI_CLIENT_SOCKET_FACTORY_ATTRIBUTE, serverCsf);
@@ -328,7 +332,7 @@ private JMXConnectorServer createServer(String serverName,
             cs = new RMIConnectorServer(serviceUrl, theEnv, server,
                     ManagementFactory.getPlatformMBeanServer());
             cs.start();
-            registry.bind("jmxrmi", server);
+            registry.bind("jmxrmi", server.toStub());
             log.info(sm.getString("jmxRemoteLifecycleListener.start",
                     Integer.toString(theRmiRegistryPort),
                     Integer.toString(theRmiServerPort), serverName));
  • webapps/docs/changelog.xml+4 −0 modified
    @@ -97,6 +97,10 @@
         StoreConfig component includes the executor name when writing the
         Connector configuration. (markt)
       </fix>
+      <fix>
+        When configuring the JMX remote listener, specify the allowed types for
+        the credentials. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

61

News mentions

0

No linked articles in our index yet.