Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web
    applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld
    files of arbitrary web applications via a crafted application that is loaded earlier than the target
    application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression. (CVE-2011-2481)

The remote host is affected by the vulnerability described in GLSA-201206-24 (Apache Tomcat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache Tomcat. Please       review the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities allow an attacker to cause a Denial of Service, to       hijack a session, to bypass authentication, to inject webscript, to       enumerate valid usernames, to read, modify and overwrite arbitrary files,       to bypass intended access restrictions, to delete work-directory files,       to discover the server&rsquo;s hostname or IP, to bypass read permissions for       files or HTTP headers, to read or write files outside of the intended       working directory, and to obtain sensitive information by reading a log       file.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
418560	SCA: security update for org.apache.tomcat:tomcat (GHSA-r7c8-hghc-2mp8)	Tenable Cloud Security	SCA Checks	medium
418560	SCA: security update for org.apache.tomcat:tomcat (GHSA-r7c8-hghc-2mp8)	Tenable Self-Hosted Container Security	SCA Checks	medium
59677	GLSA-201206-24 : Apache Tomcat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2011-2481

medium

Tenable Plugins

medium

medium

medium