WaratekVRT Sign in

CVE-2016-5425 Tomcat

Affected softwareTomcat
Severity7.8 High CVSS 3.1 2 scores
WeaknessCWE-276
Published13 Oct 2016
Updated17 Jun 2026

Description

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

Exploitation status

Working exploit published

A reviewed exploit catalogue lists ready-to-run exploit code for this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 2 indexed Published artifacts you can open, in Exploit-DB, Metasploit; first seen 2016-10-10.
  • EPSS 3.8% chance in 30 days
IndexArtifactStarsFirst seen
Exploit-DB Apache Tomcat 8/7/6 (RedHat Based Distros) - Local Privilege Escalation 2016-10-10
Metasploit Apache Tomcat on RedHat Based Systems Insecure Temp Config Privilege Escalation (manual rank)

Waratek protection

Mitigation candidate

A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.

  • Protection none
  • Action unverified
  • Review automated Inferred
  • Record active
Decided by An indexed exploit clearing the evidence bar to reverse-engineer, where there is no source to read
Finding Mitigation candidate: 2 public proof-of-concept exploit(s) are indexed for this CVE (exploit-db, metasploit), but the affected code is not open source. That makes an ARMR patch rule a candidate rather than a plan. The exploit gives a reproducible entry point to trace inward from and a test to validate a hook against, which is what makes reverse engineering tractable at all. No rule exists and none is scheduled: the hook point must be recovered by decompiling the affected code, and a closer look may find none that ARMR can act on.

CVSS

7.8 HIGH v3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 7.2 none AV:L/AC:L/Au:N/C:C/I:C/A:C NVD Primary

Affected software and releases

Products and versions

1 product, 1 version entry
SourceVendorProductSchemeAffected versions
nvd apache tomcat generic any version

References

URLTags
http://legalhackers.com/advisories/Tomcat-RedHat-Pkgs-Root-PrivEsc-Exploit-CVE-2016-5425.html Exploit, Third Party Advisory
http://packetstormsecurity.com/files/139041/Apache-Tomcat-8-7-6-Privilege-Escalation.html Exploit, Third Party Advisory, VDB Entry
http://rhn.redhat.com/errata/RHSA-2016-2046.html Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/10/10/2 Mailing List, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html Third Party Advisory
http://www.securityfocus.com/bid/93472 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036979 Third Party Advisory, VDB Entry
https://lists.apache.org/thread.html/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d%40%3Cissues.activemq.apache.org%3E
https://www.exploit-db.com/exploits/40488/ Third Party Advisory, VDB Entry
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html Third Party Advisory

Timeline
Published2016-10-13By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.