PT-2011-4414 · Apache · Apache Tomcat

Ate Douma · Publicado 2011-10-01 · Atualizado 2017-05-23 · CVE-2011-3376

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Média

Vetor base

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions prior to 7.0.22

Description The issue allows local users to gain privileges by using an untrusted web application to access the Manager application's functionality. This only affects environments running untrusted web applications, such as shared hosting environments. The vulnerability enables an untrusted web application to use the Manager application's functionality, potentially allowing it to obtain information on running web applications and deploy additional web applications.

Recommendations For Apache Tomcat versions prior to 7.0.22, update to version 7.0.22 or later to resolve the issue. As a temporary workaround, consider restricting access to the Manager application's functionality to only trusted web applications.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2011-3376

Produtos afetados

Apache Tomcat

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2011-3376 · Nota de Segurança
• http://svn.apache.org/viewvc?view=revision&revision=1176588 · Nota
• http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/core/DefaultInstanceManager.java?r1=1176588&r2=1176587&pathrev=1176588 · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3376 · Nota
• https://tomcat.apache.org/security-7 · Nota
• http://tomcat.apache.org/security-7.html · Aviso do Fabricante
• http://securityfocus.com/bid/50603 · Nota