VULNERABILITY INTELLIGENCE

CVE-2014-7810

CVSS score5 MEDIUM
EPSS probability13.35%
CISA KEVNot currently listed
Published2015-06-07
Last modified2026-10-14
CVSS vectorAV:N/AC:L/Au:N/C:N/I:P/A:N

Description

The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.

Weakness classification

  • CWE-284: Improper Access Control

Primary references