GitHub Advisoryadvisory · Maven

GHSA-r7c8-hghc-2mp8 Apache Tomcat Allows Replacing of XML Parser

MEDIUM Published 2022-05-17 Modified 2024-02-21 Official page ↗
Aliases
CVE-2011-2481
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2023-02-14

Affected packages

• Maven org.apache.tomcat:tomcat: >= 7.0.0, < 7.0.17 → fixed in 7.0.17

Description

Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.

Related

Alias · CVE (1)

  • CVE-2011-2481 Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References