Description
Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1088 and CVE-2011-1419.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 7.0.11, < 7.0.12 | 7.0.12 | GHSA-p26v-97vp-jcx6 |
References
- oval:org.mitre.oval:def:12701 vdb-entry signature
- 47196 vdb-entry
- http://tomcat.apache.org/security-7.html
- 8187 third-party-advisory
- 20110406 [SECURITY] CVE-2011-1183 Apache Tomcat security constraint bypass mailing-list
- 20110406 [SECURITY] CVE-2011-1183 Apache Tomcat security constraint bypass mailing-list
- http://svn.apache.org/viewvc?view=revision&revision=1087643
- tomcat-webxml-security-bypass(66675) vdb-entry