GitHub Advisoryadvisory · Maven

GHSA-vch7-92vf-jm44 Apache Tomcat does not follow ServletSecurity annotations

MEDIUM Published 2022-05-17 Modified 2024-01-19 Official page ↗
Aliases
CVE-2011-1419
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
Moderate
Weaknesses
CWE-284
Reviewed
2024-01-19

Affected packages

• Maven org.apache.tomcat:tomcat: >= 7.0, < 7.0.11 → fixed in 7.0.11

Description

Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.

Related

Alias · CVE (1)

  • CVE-2011-1419 Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References