PT-2011-3236 · Apache+1 · Apache Tomcat+2

Published 2011-05-12 · Updated 2023-02-13 · CVE-2011-1582

OSV

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2011-1582

GHSA-3XPJ-JGV5-Q4VV

Affected Products

Apache Tomcat

Apache Tomcat New

Org.Apache.Tomcat:Tomcat

References · 17

• https://osv.dev/vulnerability/GHSA-3xpj-jgv5-q4vv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-1582 · Security Note
• http://svn.apache.org/viewvc?view=revision&revision=1100832 · Patch
• http://securityfocus.com/bid/47886 · Patch
• http://vupen.com/english/advisories/2011/1255 · Vendor Advisory
• http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.14_%28released_12_May_2011%29 · Vendor Advisory
• https://github.com/apache/tomcat · Note
• https://github.com/apache/tomcat/commit/299b26af66793438c323ea6b18462fa44683080f · Note
• http://mail-archives.apache.org/mod_mbox/www-announce/201105.mbox/[e-mail]%3E · Note
• https://tomcat.apache.org/security-7 · Note
• https://web.archive.org/web/20170202135510/http://securityfocus.com/bid/47886 · Note
• http://mail-archives.apache.org/mod_mbox/www-announce/201105.mbox/%3C4DD26E30.2060103%40apache.org%3E · Note
• http://securityreason.com/securityalert/8256 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1582 · Note
• https://web.archive.org/web/20111110135226/http://securityfocus.com/archive/1/518032/100/0/threaded · Note