Description
Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 7.0.0, < 7.0.10 | 7.0.10 | GHSA-mg4v-rf8p-ghqq |
References
- tomcat-servletsecurity-sec-bypass(65971) vdb-entry
- 20110315 [SECURITY] CVE-2011-1088 Apache Tomcat security constraint bypass mailing-list
- 43684 third-party-advisory
- 46685 vdb-entry
- ADV-2011-0563 vdb-entry
- http://tomcat.apache.org/security-7.html
- http://svn.apache.org/viewvc?view=revision&revision=1076587
- 71027 vdb-entry
- 1025215 vdb-entry
- [announce] 20110302 [SECURITY] Tomcat 7 ignores @ServletSecurity annotations mailing-list
- http://svn.apache.org/viewvc?view=revision&revision=1076586
- [users] 20110302 Re: @DenyAll does nothing mailing-list
- http://svn.apache.org/viewvc?view=revision&revision=1077995
- [users] 20110302 Re: @DenyAll does nothing mailing-list