NVD Vulnerability Detail

CVE-2016-0706

Summary	Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.
Publication Date	Feb. 25, 2016, 10:59 a.m.
Registration Date	Jan. 26, 2021, 2:04 p.m.
Last Update	Nov. 21, 2024, 11:42 a.m.

CVSS3.0 : MEDIUM
スコア	4.3
Vector	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	低
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	低
完全性への影響(I)	なし
可用性への影響(A)	なし

CVSS2.0 : MEDIUM
Score	4.0
Vector	AV:N/AC:L/Au:S/C:P/I:N/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	単一
機密性への影響(C)	低
完全性への影響(I)	なし
可用性への影響(A)	なし
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:12.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:15.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:8.0:::::::*
cpe:2.3:o:debian:debian_linux:7.0:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat:7.0.2:beta::::::
cpe:2.3:a:apache:tomcat:6.0.33:::::::*
cpe:2.3:a:apache:tomcat:6.0.0:alpha::::::
cpe:2.3:a:apache:tomcat:8.0.30:::::::*
cpe:2.3:a:apache:tomcat:6.0.39:::::::*
cpe:2.3:a:apache:tomcat:7.0.12:::::::*
cpe:2.3:a:apache:tomcat:7.0.62:::::::*
cpe:2.3:a:apache:tomcat:8.0.17:::::::*
cpe:2.3:a:apache:tomcat:7.0.53:::::::*
cpe:2.3:a:apache:tomcat:6.0.4:alpha::::::
cpe:2.3:a:apache:tomcat:7.0.20:::::::*
cpe:2.3:a:apache:tomcat:6.0.11:::::::*
cpe:2.3:a:apache:tomcat:7.0.34:::::::*
cpe:2.3:a:apache:tomcat:8.0.26:::::::*
cpe:2.3:a:apache:tomcat:7.0.55:::::::*
cpe:2.3:a:apache:tomcat:7.0.4:beta::::::
cpe:2.3:a:apache:tomcat:7.0.63:::::::*
cpe:2.3:a:apache:tomcat:8.0.20:::::::*
cpe:2.3:a:apache:tomcat:6.0.4:::::::*
cpe:2.3:a:apache:tomcat:7.0.22:::::::*
cpe:2.3:a:apache:tomcat:7.0.39:::::::*
cpe:2.3:a:apache:tomcat:7.0.26:::::::*
cpe:2.3:a:apache:tomcat:7.0.28:::::::*
cpe:2.3:a:apache:tomcat:8.0.1:::::::*
cpe:2.3:a:apache:tomcat:8.0.0:rc3::::::
cpe:2.3:a:apache:tomcat:7.0.59:::::::*
cpe:2.3:a:apache:tomcat:7.0.65:::::::*
cpe:2.3:a:apache:tomcat:6.0.44:::::::*
cpe:2.3:a:apache:tomcat:7.0.50:::::::*
cpe:2.3:a:apache:tomcat:7.0.6:::::::*
cpe:2.3:a:apache:tomcat:6.0.20:::::::*
cpe:2.3:a:apache:tomcat:8.0.12:::::::*
cpe:2.3:a:apache:tomcat:7.0.14:::::::*
cpe:2.3:a:apache:tomcat:6.0.10:::::::*
cpe:2.3:a:apache:tomcat:8.0.27:::::::*
cpe:2.3:a:apache:tomcat:8.0.15:::::::*
cpe:2.3:a:apache:tomcat:6.0.29:::::::*
cpe:2.3:a:apache:tomcat:7.0.11:::::::*
cpe:2.3:a:apache:tomcat:7.0.67:::::::*
cpe:2.3:a:apache:tomcat:8.0.0:rc1::::::
cpe:2.3:a:apache:tomcat:7.0.23:::::::*
cpe:2.3:a:apache:tomcat:7.0.0:beta::::::
cpe:2.3:a:apache:tomcat:6.0.1:alpha::::::
cpe:2.3:a:apache:tomcat:6.0.24:::::::*
cpe:2.3:a:apache:tomcat:8.0.22:::::::*
cpe:2.3:a:apache:tomcat:8.0.29:::::::*
cpe:2.3:a:apache:tomcat:6.0.37:::::::*
cpe:2.3:a:apache:tomcat:7.0.52:::::::*
cpe:2.3:a:apache:tomcat:7.0.42:::::::*
cpe:2.3:a:apache:tomcat:6.0.32:::::::*
cpe:2.3:a:apache:tomcat:6.0.28:::::::*
cpe:2.3:a:apache:tomcat:7.0.37:::::::*
cpe:2.3:a:apache:tomcat:7.0.29:::::::*
cpe:2.3:a:apache:tomcat:8.0.11:::::::*
cpe:2.3:a:apache:tomcat:8.0.24:::::::*
cpe:2.3:a:apache:tomcat:8.0.0:rc10::::::
cpe:2.3:a:apache:tomcat:8.0.23:::::::*
cpe:2.3:a:apache:tomcat:6.0.0:::::::*
cpe:2.3:a:apache:tomcat:7.0.47:::::::*
cpe:2.3:a:apache:tomcat:7.0.5:beta::::::
cpe:2.3:a:apache:tomcat:8.0.21:::::::*
cpe:2.3:a:apache:tomcat:6.0.14:::::::*
cpe:2.3:a:apache:tomcat:7.0.41:::::::*
cpe:2.3:a:apache:tomcat:7.0.30:::::::*
cpe:2.3:a:apache:tomcat:7.0.19:::::::*
cpe:2.3:a:apache:tomcat:7.0.16:::::::*
cpe:2.3:a:apache:tomcat:6.0.41:::::::*
cpe:2.3:a:apache:tomcat:7.0.10:::::::*
cpe:2.3:a:apache:tomcat:8.0.18:::::::*
cpe:2.3:a:apache:tomcat:6.0.1:::::::*
cpe:2.3:a:apache:tomcat:7.0.25:::::::*
cpe:2.3:a:apache:tomcat:7.0.54:::::::*
cpe:2.3:a:apache:tomcat:7.0.35:::::::*
cpe:2.3:a:apache:tomcat:7.0.61:::::::*
cpe:2.3:a:apache:tomcat:8.0.3:::::::*
cpe:2.3:a:apache:tomcat:6.0.18:::::::*
cpe:2.3:a:apache:tomcat:7.0.57:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:alpha::::::
cpe:2.3:a:apache:tomcat:8.0.14:::::::*
cpe:2.3:a:apache:tomcat:8.0.0:rc5::::::
cpe:2.3:a:apache:tomcat:7.0.32:::::::*
cpe:2.3:a:apache:tomcat:6.0.43:::::::*
cpe:2.3:a:apache:tomcat:7.0.21:::::::*
cpe:2.3:a:apache:tomcat:7.0.27:::::::*
cpe:2.3:a:apache:tomcat:7.0.40:::::::*
cpe:2.3:a:apache:tomcat:6.0.30:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:beta::::::
cpe:2.3:a:apache:tomcat:6.0.13:::::::*
cpe:2.3:a:apache:tomcat:7.0.56:::::::*
cpe:2.3:a:apache:tomcat:6.0.26:::::::*
cpe:2.3:a:apache:tomcat:8.0.28:::::::*
cpe:2.3:a:apache:tomcat:7.0.64:::::::*
cpe:2.3:a:apache:tomcat:6.0.35:::::::*
cpe:2.3:a:apache:tomcat:6.0.16:::::::*
cpe:2.3:a:apache:tomcat:6.0.36:::::::*
cpe:2.3:a:apache:tomcat:7.0.33:::::::*
cpe:2.3:a:apache:tomcat:9.0.0:milestone1::::::

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html
2	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html
3	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html
4	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html
5	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html
6	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html
7	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html
8	http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html
9	http://marc.info/?l=bugtraq&m=145974991225029&w=2	Third Party Advisory
10	http://marc.info/?l=bugtraq&m=145974991225029&w=2	Third Party Advisory
11	http://rhn.redhat.com/errata/RHSA-2016-1089.html
12	http://rhn.redhat.com/errata/RHSA-2016-1089.html
13	http://rhn.redhat.com/errata/RHSA-2016-2045.html
14	http://rhn.redhat.com/errata/RHSA-2016-2045.html
15	http://rhn.redhat.com/errata/RHSA-2016-2599.html
16	http://rhn.redhat.com/errata/RHSA-2016-2599.html
17	http://rhn.redhat.com/errata/RHSA-2016-2807.html
18	http://rhn.redhat.com/errata/RHSA-2016-2807.html
19	http://rhn.redhat.com/errata/RHSA-2016-2808.html
20	http://rhn.redhat.com/errata/RHSA-2016-2808.html
21	http://seclists.org/bugtraq/2016/Feb/144	Mailing List
22	http://seclists.org/bugtraq/2016/Feb/144	Mailing List
23	http://svn.apache.org/viewvc?view=revision&revision=1722799	Issue Tracking
24	http://svn.apache.org/viewvc?view=revision&revision=1722799	Issue Tracking
25	http://svn.apache.org/viewvc?view=revision&revision=1722800
26	http://svn.apache.org/viewvc?view=revision&revision=1722800
27	http://svn.apache.org/viewvc?view=revision&revision=1722801	Issue Tracking
28	http://svn.apache.org/viewvc?view=revision&revision=1722801	Issue Tracking
29	http://svn.apache.org/viewvc?view=revision&revision=1722802	Issue Tracking
30	http://svn.apache.org/viewvc?view=revision&revision=1722802	Issue Tracking
31	http://tomcat.apache.org/security-6.html	Vendor Advisory
32	http://tomcat.apache.org/security-6.html	Vendor Advisory
33	http://tomcat.apache.org/security-7.html	Vendor Advisory
34	http://tomcat.apache.org/security-7.html	Vendor Advisory
35	http://tomcat.apache.org/security-8.html	Vendor Advisory
36	http://tomcat.apache.org/security-8.html	Vendor Advisory
37	http://tomcat.apache.org/security-9.html	Vendor Advisory
38	http://tomcat.apache.org/security-9.html	Vendor Advisory
39	http://www.debian.org/security/2016/dsa-3530	Mailing List Third Party Advisory
40	http://www.debian.org/security/2016/dsa-3530	Mailing List Third Party Advisory
41	http://www.debian.org/security/2016/dsa-3552	Third Party Advisory
42	http://www.debian.org/security/2016/dsa-3552	Third Party Advisory
43	http://www.debian.org/security/2016/dsa-3609	Third Party Advisory
44	http://www.debian.org/security/2016/dsa-3609	Third Party Advisory
45	http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
46	http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
47	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
48	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
49	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
50	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
51	http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
52	http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
53	http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
54	http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
55	http://www.securityfocus.com/bid/83324
56	http://www.securityfocus.com/bid/83324
57	http://www.securitytracker.com/id/1035069
58	http://www.securitytracker.com/id/1035069
59	http://www.ubuntu.com/usn/USN-3024-1	Third Party Advisory
60	http://www.ubuntu.com/usn/USN-3024-1	Third Party Advisory
61	https://access.redhat.com/errata/RHSA-2016:1087
62	https://access.redhat.com/errata/RHSA-2016:1087
63	https://access.redhat.com/errata/RHSA-2016:1088
64	https://access.redhat.com/errata/RHSA-2016:1088
65	https://bto.bluecoat.com/security-advisory/sa118
66	https://bto.bluecoat.com/security-advisory/sa118
67	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964	Vendor Advisory
68	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964	Vendor Advisory
69	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442	Third Party Advisory
70	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442	Third Party Advisory
71	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626	Third Party Advisory
72	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626	Third Party Advisory
73	https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E
74	https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E
75	https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E
76	https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E
77	https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E
78	https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E
79	https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E
80	https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E
81	https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E
82	https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E
83	https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E
84	https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E
85	https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
86	https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
87	https://security.gentoo.org/glsa/201705-09
88	https://security.gentoo.org/glsa/201705-09
89	https://security.netapp.com/advisory/ntap-20180531-0001/
90	https://security.netapp.com/advisory/ntap-20180531-0001/

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-200	情報漏えい	https://cwe.mitre.org/data/definitions/200.html

JVN Vulnerability Information

Apache Tomcat における SecurityManager の制限を回避される脆弱性

Title	Apache Tomcat における SecurityManager の制限を回避される脆弱性
Summary	Apache Tomcat は、org.apache.catalina.manager.StatusManagerServlet を org/apache/catalina/core/RestrictedServlets.properties リスト上に配置しないため、SecurityManager の制限を回避され、任意の HTTP リクエストを読まれ、その結果、セッション ID の値を取得される脆弱性が存在します。
Possible impacts	リモート認証されたユーザにより、巧妙に細工された Web アプリケーションを介して、SecurityManager の制限を回避され、任意の HTTP リクエストを読まれ、その結果、セッション ID の値を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 5, 2016, midnight
Registration Date	March 2, 2016, 3:58 p.m.
Last Update	Nov. 21, 2016, 3:32 p.m.

Affected System

Apache Software Foundation

Apache Tomcat 6.0.45 未満の 6.x

Apache Tomcat 7.0.68 未満の 7.x

Apache Tomcat 8.0.32 未満の 8.x

Apache Tomcat 9.0.0.M3 未満の 9.x

Debian

Debian GNU/Linux

Canonical

Ubuntu

ヒューレット・パッカード・エンタープライズ

HP-UX Tomcat-based Servlet Engine

OpenVMS CSWS JAVA

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-0706	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0706
National Vulnerability Database (NVD)
2	CVE-2016-0706	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0706

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
Apache Tomcat
1	Fixed in Apache Tomcat 6.0.45	http://tomcat.apache.org/security-6.html
2	Fixed in Apache Tomcat 7.0.68	http://tomcat.apache.org/security-7.html
3	Fixed in Apache Tomcat 8.0.32	http://tomcat.apache.org/security-8.html
4	Fixed in Apache Tomcat 9.0.0.M3	http://tomcat.apache.org/security-9.html
Apache-SVN
5	Revision 1722799	http://svn.apache.org/viewvc?view=revision&revision=1722799
6	Revision 1722800	http://svn.apache.org/viewvc?view=revision&revision=1722800
7	Revision 1722801	http://svn.apache.org/viewvc?view=revision&revision=1722801
8	Revision 1722802	http://svn.apache.org/viewvc?view=revision&revision=1722802
Debian Security Advisory
9	DSA-3530	http://www.debian.org/security/2016/dsa-3530
10	DSA-3552	http://www.debian.org/security/2016/dsa-3552
11	DSA-3609	http://www.debian.org/security/2016/dsa-3609
HPE Security Bulletin
12	HPSBOV03615	https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05158626
13	HPSBUX03561	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964
14	HPSBUX03606	https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05150442
Oracle Critical Patch Update
15	Oracle Critical Patch Update Advisory - October 2016	http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
Oracle Technology Network
16	Oracle Linux Bulletin - October 2016	http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
17	Oracle Solaris Third Party Bulletin - April 2016	http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
Red Hat Security Advisory
18	RHSA-2016:2045	http://rhn.redhat.com/errata/RHSA-2016-2045.html
Ubuntu Security Notice
19	USN-3024-1	http://www.ubuntu.com/usn/USN-3024-1

その他

No	Name	URL
JVN
1	JVNVU#94679988	http://jvn.jp/vu/JVNVU94679988/

Change Log

No	Changed Details	Date of change
0	[2016年03月02日] 掲載 [2016年06月24日] ベンダ情報：ヒューレット・パッカード・エンタープライズ (HPSBUX03606) を追加ベンダ情報：ヒューレット・パッカード・エンタープライズ (HPSBOV03615) を追加 [2016年09月07日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：ヒューレット・パッカード・エンタープライズ (HPSBUX03561) を追加ベンダ情報：Debian (DSA-3530) を追加ベンダ情報：Debian (DSA-3552) を追加ベンダ情報：Debian (DSA-3609) を追加ベンダ情報：Canonical (USN-3024-1) を追加 [2016年11月21日] ベンダ情報：オラクル (Oracle Solaris Third Party Bulletin - April 2016) を追加ベンダ情報：オラクル (Oracle Linux Bulletin - October 2016) を追加ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - October 2016) を追加ベンダ情報：レッドハット (RHSA-2016:2045) を追加	Feb. 17, 2018, 10:37 a.m.

Configuration3	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat:7.0.2:beta::::::
cpe:2.3:a:apache:tomcat:6.0.33:::::::*
cpe:2.3:a:apache:tomcat:6.0.0:alpha::::::
cpe:2.3:a:apache:tomcat:8.0.30:::::::*
cpe:2.3:a:apache:tomcat:6.0.39:::::::*
cpe:2.3:a:apache:tomcat:7.0.12:::::::*
cpe:2.3:a:apache:tomcat:7.0.62:::::::*
cpe:2.3:a:apache:tomcat:8.0.17:::::::*
cpe:2.3:a:apache:tomcat:7.0.53:::::::*
cpe:2.3:a:apache:tomcat:6.0.4:alpha::::::
cpe:2.3:a:apache:tomcat:7.0.20:::::::*
cpe:2.3:a:apache:tomcat:6.0.11:::::::*
cpe:2.3:a:apache:tomcat:7.0.34:::::::*
cpe:2.3:a:apache:tomcat:8.0.26:::::::*
cpe:2.3:a:apache:tomcat:7.0.55:::::::*
cpe:2.3:a:apache:tomcat:7.0.4:beta::::::
cpe:2.3:a:apache:tomcat:7.0.63:::::::*
cpe:2.3:a:apache:tomcat:8.0.20:::::::*
cpe:2.3:a:apache:tomcat:6.0.4:::::::*
cpe:2.3:a:apache:tomcat:7.0.22:::::::*
cpe:2.3:a:apache:tomcat:7.0.39:::::::*
cpe:2.3:a:apache:tomcat:7.0.26:::::::*
cpe:2.3:a:apache:tomcat:7.0.28:::::::*
cpe:2.3:a:apache:tomcat:8.0.1:::::::*
cpe:2.3:a:apache:tomcat:8.0.0:rc3::::::
cpe:2.3:a:apache:tomcat:7.0.59:::::::*
cpe:2.3:a:apache:tomcat:7.0.65:::::::*
cpe:2.3:a:apache:tomcat:6.0.44:::::::*
cpe:2.3:a:apache:tomcat:7.0.50:::::::*
cpe:2.3:a:apache:tomcat:7.0.6:::::::*
cpe:2.3:a:apache:tomcat:6.0.20:::::::*
cpe:2.3:a:apache:tomcat:8.0.12:::::::*
cpe:2.3:a:apache:tomcat:7.0.14:::::::*
cpe:2.3:a:apache:tomcat:6.0.10:::::::*
cpe:2.3:a:apache:tomcat:8.0.27:::::::*
cpe:2.3:a:apache:tomcat:8.0.15:::::::*
cpe:2.3:a:apache:tomcat:6.0.29:::::::*
cpe:2.3:a:apache:tomcat:7.0.11:::::::*
cpe:2.3:a:apache:tomcat:7.0.67:::::::*
cpe:2.3:a:apache:tomcat:8.0.0:rc1::::::
cpe:2.3:a:apache:tomcat:7.0.23:::::::*
cpe:2.3:a:apache:tomcat:7.0.0:beta::::::
cpe:2.3:a:apache:tomcat:6.0.1:alpha::::::
cpe:2.3:a:apache:tomcat:6.0.24:::::::*
cpe:2.3:a:apache:tomcat:8.0.22:::::::*
cpe:2.3:a:apache:tomcat:8.0.29:::::::*
cpe:2.3:a:apache:tomcat:6.0.37:::::::*
cpe:2.3:a:apache:tomcat:7.0.52:::::::*
cpe:2.3:a:apache:tomcat:7.0.42:::::::*
cpe:2.3:a:apache:tomcat:6.0.32:::::::*
cpe:2.3:a:apache:tomcat:6.0.28:::::::*
cpe:2.3:a:apache:tomcat:7.0.37:::::::*
cpe:2.3:a:apache:tomcat:7.0.29:::::::*
cpe:2.3:a:apache:tomcat:8.0.11:::::::*
cpe:2.3:a:apache:tomcat:8.0.24:::::::*
cpe:2.3:a:apache:tomcat:8.0.0:rc10::::::
cpe:2.3:a:apache:tomcat:8.0.23:::::::*
cpe:2.3:a:apache:tomcat:6.0.0:::::::*
cpe:2.3:a:apache:tomcat:7.0.47:::::::*
cpe:2.3:a:apache:tomcat:7.0.5:beta::::::
cpe:2.3:a:apache:tomcat:8.0.21:::::::*
cpe:2.3:a:apache:tomcat:6.0.14:::::::*
cpe:2.3:a:apache:tomcat:7.0.41:::::::*
cpe:2.3:a:apache:tomcat:7.0.30:::::::*
cpe:2.3:a:apache:tomcat:7.0.19:::::::*
cpe:2.3:a:apache:tomcat:7.0.16:::::::*
cpe:2.3:a:apache:tomcat:6.0.41:::::::*
cpe:2.3:a:apache:tomcat:7.0.10:::::::*
cpe:2.3:a:apache:tomcat:8.0.18:::::::*
cpe:2.3:a:apache:tomcat:6.0.1:::::::*
cpe:2.3:a:apache:tomcat:7.0.25:::::::*
cpe:2.3:a:apache:tomcat:7.0.54:::::::*
cpe:2.3:a:apache:tomcat:7.0.35:::::::*
cpe:2.3:a:apache:tomcat:7.0.61:::::::*
cpe:2.3:a:apache:tomcat:8.0.3:::::::*
cpe:2.3:a:apache:tomcat:6.0.18:::::::*
cpe:2.3:a:apache:tomcat:7.0.57:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:alpha::::::
cpe:2.3:a:apache:tomcat:8.0.14:::::::*
cpe:2.3:a:apache:tomcat:8.0.0:rc5::::::
cpe:2.3:a:apache:tomcat:7.0.32:::::::*
cpe:2.3:a:apache:tomcat:6.0.43:::::::*
cpe:2.3:a:apache:tomcat:7.0.21:::::::*
cpe:2.3:a:apache:tomcat:7.0.27:::::::*
cpe:2.3:a:apache:tomcat:7.0.40:::::::*
cpe:2.3:a:apache:tomcat:6.0.30:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:::::::*
cpe:2.3:a:apache:tomcat:6.0.2:beta::::::
cpe:2.3:a:apache:tomcat:6.0.13:::::::*
cpe:2.3:a:apache:tomcat:7.0.56:::::::*
cpe:2.3:a:apache:tomcat:6.0.26:::::::*
cpe:2.3:a:apache:tomcat:8.0.28:::::::*
cpe:2.3:a:apache:tomcat:7.0.64:::::::*
cpe:2.3:a:apache:tomcat:6.0.35:::::::*
cpe:2.3:a:apache:tomcat:6.0.16:::::::*
cpe:2.3:a:apache:tomcat:6.0.36:::::::*
cpe:2.3:a:apache:tomcat:7.0.33:::::::*
cpe:2.3:a:apache:tomcat:9.0.0:milestone1::::::