Description
org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application, which allows local users to gain privileges by using an untrusted web application to access the Manager application's functionality.
Remediation
References
http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/core/DefaultInstanceManager.java?r1=1176588&r2=1176587&pathrev=1176588
http://svn.apache.org/viewvc?view=revision&revision=1176588
http://tomcat.apache.org/security-7.html
http://www.securityfocus.com/bid/50603
Related Vulnerabilities
CVE-2023-46233 Vulnerability in maven package org.webjars.bower:crypto-js
CVE-2022-39299 Vulnerability in npm package @node-saml/passport-saml
CVE-2023-40827 Vulnerability in maven package org.pf4j:pf4j
CVE-2018-14627 Vulnerability in maven package org.wildfly:wildfly-feature-pack
CVE-2021-23346 Vulnerability in maven package org.webjars.npm:html-parse-stringify2