Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity
    annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a
    web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.
    (CVE-2011-1419)

The remote host is affected by the vulnerability described in GLSA-201206-24 (Apache Tomcat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache Tomcat. Please       review the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities allow an attacker to cause a Denial of Service, to       hijack a session, to bypass authentication, to inject webscript, to       enumerate valid usernames, to read, modify and overwrite arbitrary files,       to bypass intended access restrictions, to delete work-directory files,       to discover the server&rsquo;s hostname or IP, to bypass read permissions for       files or HTTP headers, to read or write files outside of the intended       working directory, and to obtain sensitive information by reading a log       file.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
434423	SCA: security update for org.apache.tomcat:tomcat (GHSA-vch7-92vf-jm44)	Tenable Cloud Security	SCA Checks	medium
434423	SCA: security update for org.apache.tomcat:tomcat (GHSA-vch7-92vf-jm44)	Tenable Self-Hosted Container Security	SCA Checks	medium
59677	GLSA-201206-24 : Apache Tomcat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2011-1419

medium

Tenable Plugins

medium

medium

medium