Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1wMjZ2LTk3dnAtamN4Ns4AAWNP

Access controll bypass in Apache Tomcat

Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1088 and CVE-2011-1419.

Permalink: https://github.com/advisories/GHSA-p26v-97vp-jcx6
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wMjZ2LTk3dnAtamN4Ns4AAWNP
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 2 months ago

Identifiers: GHSA-p26v-97vp-jcx6, CVE-2011-1183
References:

• https://nvd.nist.gov/vuln/detail/CVE-2011-1183
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66675
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12701
• http://seclists.org/fulldisclosure/2011/Apr/96
• http://securityreason.com/securityalert/8187
• http://svn.apache.org/viewvc?view=revision&revision=1087643
• http://tomcat.apache.org/security-7.html
• https://github.com/apache/tomcat/commit/b7b5c63a932f6c1ea05f9b65ad9054247bb5af57
• https://web.archive.org/web/20200229122300/http://www.securityfocus.com/bid/47196
• https://web.archive.org/web/20200928033804/http://www.securityfocus.com/archive/1/517362/100/0/threaded
• https://github.com/advisories/GHSA-p26v-97vp-jcx6

Repository: https://github.com/apache/tomcat
Blast Radius: 0.0

Affected Packages