Apache Tomcat CVE-2016-6794 Vulnerability

Description

When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. Tomcat's system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.

Affected Applications

Apache Tomcat

CVE References

Other References