CVE-2011-3376

2011-11-1121:55:00

CWE-264

[email protected]

web.nvd.nist.gov

cve-2011-3376

apache tomcat

containerservlets

manager application

security vulnerability

6.4 Medium

AI Score

Confidence

Low

4.4 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.2%

JSON

org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application, which allows local users to gain privileges by using an untrusted web application to access the Manager application’s functionality.

CPENameOperatorVersion
apache:tomcatapache tomcateq7.0.12
apache:tomcatapache tomcateq7.0.20
apache:tomcatapache tomcateq7.0.8
apache:tomcatapache tomcateq7.0.1
apache:tomcatapache tomcateq7.0.2
apache:tomcatapache tomcateq7.0.5
apache:tomcatapache tomcateq7.0.0
apache:tomcatapache tomcateq7.0.6
apache:tomcatapache tomcateq7.0.18
apache:tomcatapache tomcateq7.0.14

CPE	Name	Operator	Version
apache:tomcat	apache tomcat	eq	7.0.12
apache:tomcat	apache tomcat	eq	7.0.20
apache:tomcat	apache tomcat	eq	7.0.8
apache:tomcat	apache tomcat	eq	7.0.1
apache:tomcat	apache tomcat	eq	7.0.2
apache:tomcat	apache tomcat	eq	7.0.5
apache:tomcat	apache tomcat	eq	7.0.0
apache:tomcat	apache tomcat	eq	7.0.6
apache:tomcat	apache tomcat	eq	7.0.18
apache:tomcat	apache tomcat	eq	7.0.14