PT-2011-3901 · Apache · Apache Tomcat

Arjen Knibbe · Published 2011-07-19 · Updated 2023-02-13 · CVE-2011-2481

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 7.0.0 through 7.0.16

Description The issue allows local users to read or modify the web.xml, context.xml, or tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. This occurs because of a regression of a previously reported issue, which was re-introduced during the re-factoring of XML validation for Tomcat 7.0.x. If a web application is the first to be loaded, it may potentially view and/or alter the files of other web applications deployed on the Tomcat instance.

Recommendations For Apache Tomcat versions 7.0.0 through 7.0.16, update to version 7.0.17 or later to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2011-2481

GHSA-R7C8-HGHC-2MP8

Affected Products

Apache Tomcat

References · 16

• 🔥 https://issues.apache.org/bugzilla/show_bug.cgi?id=51395 · Exploit
• http://svn.apache.org/viewvc?view=revision&revision=1138788 · Patch
• https://osv.dev/vulnerability/GHSA-r7c8-hghc-2mp8 · Vendor Advisory
• http://svn.apache.org/viewvc?view=revision&revision=1137753 · Patch
• http://marc.info/?l=bugtraq&m=139344343412337&w=2 · Vendor Advisory
• http://tomcat.apache.org/security-7.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2481 · Security Note
• https://github.com/apache/tomcat · Note
• https://github.com/apache/tomcat/commit/279e4451cb996f810fbca2f78b6340412d9daa7b · Note
• http://securitytracker.com/id?1025924 · Note
• https://tomcat.apache.org/security-7 · Note
• https://web.archive.org/web/20161127215021/http://securitytracker.com/id?1025924 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2481 · Note
• http://secunia.com/advisories/57126 · Note
• https://web.archive.org/web/20111209022500/http://securityfocus.com/bid/49147 · Note