Description

Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.

Remediation

References

CVE-2011-3190

Related Vulnerabilities

e107 Other Vulnerability (CVE-2006-2590)

Liferay Portal Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2021-33320)

Moodle Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2020-1754)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2009-0502)

WordPress Plugin YITH WooCommerce Bulk Product Editing Security Bypass (1.2.13)

Severity

High

Classification

CVE-2011-3190 CWE-264

Tags

Missing Update Known Vulnerabilities