VulnerabilityModified
CVE-2011-1183
Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application.
MEDIUM 5.8EPSS 6.16%
Does this matter?
Lower severity and a low EPSS score (6.16%). Track it; it rarely justifies an emergency change on its own.
Description
Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1088 and CVE-2011-1419.
- CVSS 2.0
- 5.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
- EPSS
- 6.16% probability · 93th percentile
- CISA KEV
- Not listed
- Affected
- apache/tomcat
- Source
- secalert@redhat.com
References
- http://seclists.org/fulldisclosure/2011/Apr/96
- http://securityreason.com/securityalert/8187
- http://svn.apache.org/viewvc?view=revision&revision=1087643Patch
- http://tomcat.apache.org/security-7.html
- http://www.securityfocus.com/archive/1/517362/100/0/threaded
- http://www.securityfocus.com/bid/47196
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66675
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12701
- http://seclists.org/fulldisclosure/2011/Apr/96
- http://securityreason.com/securityalert/8187
- http://svn.apache.org/viewvc?view=revision&revision=1087643Patch
- http://tomcat.apache.org/security-7.html
- http://www.securityfocus.com/archive/1/517362/100/0/threaded
- http://www.securityfocus.com/bid/47196
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66675
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12701
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.