Description
Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 7.0, < 7.0.11 | 7.0.11 | GHSA-vch7-92vf-jm44 |
References
- tomcat-servletsecurity-sec-bypass(65971) vdb-entry
- 43684 third-party-advisory
- 46685 vdb-entry
- ADV-2011-0563 vdb-entry
- http://tomcat.apache.org/security-7.html
- 8131 third-party-advisory
- apache-servletsecurity-sec-bypass(66154) vdb-entry
- 71027 vdb-entry
- [announce] 20110302 [SECURITY] Tomcat 7 ignores @ServletSecurity annotations mailing-list
- http://svn.apache.org/viewvc?view=revision&revision=1079752
- [users] 20110302 Re: @DenyAll does nothing mailing-list
- [users] 20110302 Re: @DenyAll does nothing mailing-list
- [users] 20110309 [SECURITY] Tomcat 7 ignores @ServletSecurity annotations mailing-list