It was discovered that it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.

References

bugzilla.redhat.com/show_bug.cgi?id=1390493

tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.47 https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.72 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37

f5 2

nessus 32

prion 1

nvd 1

myhack58 1

debiancve 1

ubuntucve 1

osv 10

cve 1

debian 9

github 1

cvelist 1