Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-6816 — Improper Input Validation in Software Foundation Apache Tomcat

CWE-20 — Improper Input ValidationCWE-444 — HTTP Request SmugglingCWE-835 — Infinite Loop15 documents10 sources
Severity
7.1HIGHNVD
EPSS
2.9%
top 13.59%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Apache Software Foundation Apache TomcatApache Tomcat
Timeline
PublishedMar 20
Latest updateMay 13

Description

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from reque…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:LExploitability: 2.8 | Impact: 3.7

Affected Packages2 packages

▶NVDapache/tomcat168 versions+167

🔴Vulnerability Details

4
GHSA
Improper Input Validation in Apache Tomcat↗2022-05-13
▶
OSV
Improper Input Validation in Apache Tomcat↗2022-05-13
▶
CVEList
CVE-2016-6816: The code in Apache Tomcat 9↗2017-03-20
▶
OSV
CVE-2016-6816: The code in Apache Tomcat 9↗2016-11-23
▶

💥Exploits & PoCs

1
Exploit-DB
Apache Tomcat 6/7/8/9 - Information Disclosure↗2017-04-04
▶

📋Vendor Advisories

6
Ubuntu
Tomcat vulnerabilities↗2020-09-30
▶
Ubuntu
Tomcat vulnerabilities↗2017-01-23
▶
Red Hat
tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests↗2016-11-22
▶
Debian
CVE-2016-6816: tomcat9 - The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8....↗2016
▶
Red Hat
tomcat: Infinite loop in the processing of https requests↗2015-02-06
▶

💬Community

3
Bugzilla
CVE-2016-6816 CVE-2016-8735 tomcat: various flaws [epel-6]↗2016-11-22
▶
Bugzilla
CVE-2016-6816 CVE-2016-6817 CVE-2016-8735 tomcat: various flaws [fedora-all]↗2016-11-22
▶
Bugzilla
CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests↗2016-11-22
▶
CVE-2016-6816 — Improper Input Validation | cvebase