PT-2011-4414 · Apache · Apache Tomcat

Ate Douma · Published 2011-10-01 · Updated 2017-05-23 · CVE-2011-3376

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions prior to 7.0.22

Description The issue allows local users to gain privileges by using an untrusted web application to access the Manager application's functionality. This only affects environments running untrusted web applications, such as shared hosting environments. The vulnerability enables an untrusted web application to use the Manager application's functionality, potentially allowing it to obtain information on running web applications and deploy additional web applications.

Recommendations For Apache Tomcat versions prior to 7.0.22, update to version 7.0.22 or later to resolve the issue. As a temporary workaround, consider restricting access to the Manager application's functionality to only trusted web applications.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2011-3376

Affected Products

Apache Tomcat

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2011-3376 · Security Note
• http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/core/DefaultInstanceManager.java?r1=1176588&r2=1176587&pathrev=1176588 · Patch
• http://tomcat.apache.org/security-7.html · Vendor Advisory
• http://svn.apache.org/viewvc?view=revision&revision=1176588 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3376 · Note
• https://tomcat.apache.org/security-7 · Note
• http://securityfocus.com/bid/50603 · Note