CVEvulnerability
CVE-2011-3376
4.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2011-11-11
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.4 MEDIUM — AV:L/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application, which allows local users to gain privileges by using an untrusted web application to access the Manager application's functionality.
Affected configurations
• apache tomcat 7.0.0
• apache tomcat 7.0.1
• apache tomcat 7.0.2
• apache tomcat 7.0.3
• apache tomcat 7.0.4
• apache tomcat 7.0.5
• apache tomcat 7.0.6
• apache tomcat 7.0.7
• apache tomcat 7.0.8
• apache tomcat 7.0.9
• apache tomcat 7.0.10
• apache tomcat 7.0.11
• apache tomcat 7.0.12
• apache tomcat 7.0.13
• apache tomcat 7.0.14
• apache tomcat 7.0.15
• apache tomcat 7.0.16
• apache tomcat 7.0.17
• apache tomcat 7.0.18
• apache tomcat 7.0.19
• apache tomcat 7.0.20
• apache tomcat 7.0.21
Related
Weakness · not in database (1)
References
- http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/core/DefaultInstanceManager.java?r1=1176588&r2=1176587&pathrev=1176588 Patch
- http://svn.apache.org/viewvc?view=revision&revision=1176588 svn.apache.org
- http://tomcat.apache.org/security-7.html Vendor Advisory
- http://www.securityfocus.com/bid/50603 www.securityfocus.com
- http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/core/DefaultInstanceManager.java?r1=1176588&r2=1176587&pathrev=1176588 Patch
- http://svn.apache.org/viewvc?view=revision&revision=1176588 svn.apache.org
- http://tomcat.apache.org/security-7.html Vendor Advisory
- http://www.securityfocus.com/bid/50603 www.securityfocus.com