Technical Severity
CRITICAL
CVSS v3.1 Metrics
9.8
/ 10
Minimal Risk
Critical
Vector Specification
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation Likelihood
EPSS Prediction
93.67
%
Predictive Probability
Percentile Rank
99.8
th
Documented as more likely to be exploited than 99.8% of known CVEs.
Detection Date
May 12, 2023
Remediation Due
Jun 02, 2023
CISA Catalog Active
Threat Analysis
Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.
Remediation Directive
Apply updates per vendor instructions.