Description

Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.

Remediation

References

CVE-2011-1419

Related Vulnerabilities

Joomla! Core 1.0.x Multiple Vulnerabilities (1.0.0 - 1.0.9)

WordPress Plugin SP Project & Document Manager Multiple Vulnerabilities (2.5.9.7)

Jboss EAP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-3873)

Oracle HTTP Server Uncontrolled Resource Consumption Vulnerability (CVE-2022-25313)

WordPress Plugin Track That Stat 'data' Parameter Cross-Site Scripting (1.0.8)

Severity

Medium

Classification

CVE-2011-1419

Tags

Missing Update Known Vulnerabilities