GHSA-vch7-92vf-jm44

Suggest an improvement
Source
https://github.com/advisories/GHSA-vch7-92vf-jm44
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vch7-92vf-jm44/GHSA-vch7-92vf-jm44.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-vch7-92vf-jm44
Aliases
  • CVE-2011-1419
Published
2022-05-17T02:00:34Z
Modified
2024-01-19T19:56:48.269927Z
Summary
Apache Tomcat does not follow ServletSecurity annotations
Details

Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.

Database specific
{
    "nvd_published_at": "2011-03-14T19:55:00Z",
    "cwe_ids": [
        "CWE-284"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-19T19:29:42Z"
}
References

Affected packages

Maven / org.apache.tomcat:tomcat

Package

Name
org.apache.tomcat:tomcat
View open source insights on deps.dev
Purl
pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type
ECOSYSTEM
Events
Introduced
7.0
Fixed
7.0.11