CWE Code: 20
Vulnerability Type: privilege_escalation
CVSS Score: 7.2
CWE Name:  Improper Input Validation
Summary: the tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on ubuntu 12.04 lts, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on ubuntu 14.04 lts, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on ubuntu 16.04 lts allows local users with access to the tomcat account to gain root privileges via a symlink attack on the catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: LOCAL
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2016-10-03
Last Modified Date: 2018-10-09