CVE-2016-6325: Apache Tomcat

High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days.

The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for (1) /etc/sysconfig/tomcat and (2) /etc/tomcat/tomcat.conf, which allows local users to gain privileges by leveraging membership in the tomcat group.

Affected products

• Apache Tomcat: affected versions not specified

Published 2016-10-13. Last modified 2026-06-17.