Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.

The remote host is affected by the vulnerability described in GLSA-201206-24 (Apache Tomcat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache Tomcat. Please       review the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities allow an attacker to cause a Denial of Service, to       hijack a session, to bypass authentication, to inject webscript, to       enumerate valid usernames, to read, modify and overwrite arbitrary files,       to bypass intended access restrictions, to delete work-directory files,       to discover the server&rsquo;s hostname or IP, to bypass read permissions for       files or HTTP headers, to read or write files outside of the intended       working directory, and to obtain sensitive information by reading a log       file.
  Workaround :

    There is no known workaround at this time.

The version of Tomcat installed on the remote host is prior to 7.0.12. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_7.0.12_security-7 advisory.

  - The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining,     which allows remote attackers to read responses intended for other clients in opportunistic circumstances     by examining the application data in HTTP packets, related to a mix-up of responses for requests from     different users. (CVE-2011-1475)

  - The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before     6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass     intended access restrictions by leveraging the availability of a protection space with weaker     authentication or authorization requirements, a different vulnerability than CVE-2011-1184.
    (CVE-2011-5063)

  - Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers     to bypass intended access restrictions via HTTP requests to a web application. (CVE-2011-1088)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Apache Tomcat 7.x listening on the remote host is prior to 7.0.11, It is, therefore affected by a security bypass vulnerability.

When a web application is started, 'ServletSecurity' annotations might be ignored which could lead to some areas of the applications not being protected as expected.

Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 7.0.11. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_7.0.11_security-7 advisory.

  - Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers     to bypass intended access restrictions via HTTP requests to a web application. (CVE-2011-1088)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
59677	GLSA-201206-24 : Apache Tomcat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
53323	Apache Tomcat 7.0.0 < 7.0.12 multiple vulnerabilities	Nessus	Web Servers	medium
5816	Apache Tomcat 7.0.x < 7.0.11 Security Bypass Vulnerability	Nessus Network Monitor	Web Servers	medium
52634	Apache Tomcat 7.0.0 < 7.0.11	Nessus	Web Servers	medium

Detections

Analytics

CVE-2011-1088

medium

Tenable Plugins

medium

medium

medium

medium