Improper input validation in Apache Tomcat - CVE-2016-6816

Detailed vulnerability description

The vulnerability allows a remote attacker to manipulate HTTP responses.

The vulnerability exists due to incorrect parsing of HTTP requests. A remote attacker can send a specially crafted HTTP request containing specially crafted characters and perform XSS attacks, manipulate HTTP responses or obtain potentially sensitive data, belonging to other sessions.

Successful exploitation of the vulnerability may allow an attacker to gain access to potentially sensitive information, but requires presence of a proxy server, which does not block injected characters.

How to mitigate CVE-2016-6816

Sources

• https://tomcat.apache.org/security-6.html
• https://tomcat.apache.org/security-7.html
• https://tomcat.apache.org/security-8.html
• https://tomcat.apache.org/security-9.html