According to its self-reported version number, the instance of Apache Tomcat 7.x listening on the remote host is prior to 7.0.12. It is, therefore, affected by multiple vulnerabilities:

 - A fix for CVE-2011-1088 introduced a security bypass vulnerability. If login configuration data is absent from the 'web.xml' file and a web application is marked as 'metadata-complete', security constraints are ignored and may be bypassed by an attacker. Please note this vulnerability only affects version 7.0.11 of Tomcat. (CVE-2011-1183)

 - Several weaknesses were found in the HTTP Digest authentication implementation. The issues are as follows: replay attacks are possible, server nonces are not checked, client nonce counts are not checked, 'quality of protection' (qop) values are not checked, realm values are not checked, and the server secret is a hard-coded, known string. The effect of these issues is that Digest authentication is no stronger than Basic authentication. (CVE-2011-1184, CVE-2011-5062, CVE-2011-5063, CVE-2011-5064)

 - Updates to the HTTP BIO connector, in support of Servlet 3.0 asynchronous requests, fail to completely handle HTTP pipelining. Sensitive information may be disclosed because responses from the server can be improperly returned to the wrong request and possibly to the wrong user. (CVE-2011-1475)

Note that Nessus Network Monitor has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which
    allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete
    web application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1088 and
    CVE-2011-1419. (CVE-2011-1183)

遠端主機受到 GLSA-201206-24 中所述的弱點影響 (Apache Tomcat：多個弱點)

在 Apache Tomcat 中發現多個弱點。如需詳細資訊，請檢閱以下提及的 CVE 識別碼。
 影響：

這些弱點允許攻擊者透過讀取記錄檔造成拒絕服務、劫持工作階段、繞過驗證、插入 Web 指令碼、列舉有效的使用者名稱、讀取、修改和覆寫任意檔案、繞過預定的存取限制、刪除工作目錄檔案、探索伺服器的主機名稱或 IP、繞過檔案或 HTTP 標頭的讀取權限、讀取或寫入預定工作目錄以外的檔案，以及取得敏感資訊。
 因應措施：

目前尚無已知的因應措施。

远程主机受到 GLSA-201206-24 中所述漏洞的影响（Apache Tomcat：多种漏洞）

在 Apache Tomcat 中发现多种漏洞。请检查下面引用的 CVE 标识符以了解详细信息。
 影响：

这些漏洞允许攻击者造成拒绝服务，劫持会话，绕过认证，注入 Web 脚本，枚举有效用户名，读取、修改和覆盖任意文件，绕过预期访问限制，删除工作目录文件，发现服务器的主机名或 IP，绕过文件或 HTTP 标头的读取权限，读取或写入预期工作目录外部的文件以及通过读取日志文件来获取敏感信息。
 变通方案：

目前无任何已知的变通方案。

リモートホストが、GLSA-201206-24 で説明されている脆弱性の影響を受けます（Apache Tomcat：複数の脆弱性）

Apache Tomcat に複数の脆弱性が発見されました。詳細については、以下で参照されている CVE 識別子をレビューしてください。
 影響：

この脆弱性により、攻撃者が、サービス拒否を引き起こしたり、セッションをハイジャックしたり、認証をバイパスしたり、Web スクリプトを注入したり、有効なユーザー名を列挙したり、任意のファイルを読み取り、変更および上書きしたり、意図されたアクセス制限をバイパスしたり、作業ディレクトリのファイルを削除したり、サーバーのホスト名や IP を突き止めたり、ファイルや HTTP ヘッダーの読み取り権限をバイパスしたり、意図された作業ディレクトリ外のファイルを読み書きしたり、ログファイルを読み取ることで機密情報を取得することが可能です。
 回避策：

現時点で、既知の回避策はありません。

The remote host is affected by the vulnerability described in GLSA-201206-24 (Apache Tomcat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache Tomcat. Please       review the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities allow an attacker to cause a Denial of Service, to       hijack a session, to bypass authentication, to inject webscript, to       enumerate valid usernames, to read, modify and overwrite arbitrary files,       to bypass intended access restrictions, to delete work-directory files,       to discover the server&rsquo;s hostname or IP, to bypass read permissions for       files or HTTP headers, to read or write files outside of the intended       working directory, and to obtain sensitive information by reading a log       file.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Published	Updated	Severity
5882	Apache Tomcat 7.0.x < 7.0.12 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	4/7/2011	3/6/2019	medium
417212	SCA: security update for org.apache.tomcat:tomcat (GHSA-p26v-97vp-jcx6)	Tenable Cloud Security	SCA Checks	1/23/2025	7/2/2026	medium
417212	SCA: security update for org.apache.tomcat:tomcat (GHSA-p26v-97vp-jcx6)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	7/2/2026	medium
59677	GLSA-201206-24 : Apache Tomcat：多個弱點	Nessus	Gentoo Local Security Checks	6/25/2012	1/6/2021	medium
59677	GLSA-201206-24：Apache Tomcat：多种漏洞	Nessus	Gentoo Local Security Checks	6/25/2012	1/6/2021	medium
59677	GLSA-201206-24：Apache Tomcat：複数の脆弱性	Nessus	Gentoo Local Security Checks	6/25/2012	1/6/2021	medium
59677	GLSA-201206-24 : Apache Tomcat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	6/25/2012	1/6/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium