CWE Code: 59
Vulnerability Type: privilege_escalation
CVSS Score: 7.2
CWE Name:  Improper Link Resolution Before File Access ('Link Following')
Summary: the postinst script in the tomcat6 package before 6.0.45+dfsg-1~deb7u4 on debian wheezy, before 6.0.35-1ubuntu3.9 on ubuntu 12.04 lts and on ubuntu 14.04 lts; the tomcat7 package before 7.0.28-4+deb7u8 on debian wheezy, before 7.0.56-3+deb8u6 on debian jessie, before 7.0.52-1ubuntu0.8 on ubuntu 14.04 lts, and on ubuntu 12.04 lts, 16.04 lts, and 16.10; and the tomcat8 package before 8.0.14-1+deb8u5 on debian jessie, before 8.0.32-1ubuntu1.3 on ubuntu 16.04 lts, before 8.0.37-1ubuntu0.1 on ubuntu 16.10, and before 8.0.38-2ubuntu1 on ubuntu 17.04 might allow local users with access to the tomcat account to obtain sensitive information or gain root privileges via a symlink attack on the catalina localhost directory.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: LOCAL
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2017-03-23
Last Modified Date: 2018-08-02