GitHub Advisory DatabaseGHSA-R7C8-HGHC-2MP8Apache Tomcat Allows Replacing of XML Parser
4.6 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
0.0004 Low
EPSS
Percentile
9.5%
Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
| CPE | Name | Operator | Version |
|---|---|---|---|
| org.apache.tomcat:tomcat | lt | 7.0.17 |
References
marc.info/?l=bugtraq&m=139344343412337&w=2
svn.apache.org/viewvc?view=revision&revision=1137753
svn.apache.org/viewvc?view=revision&revision=1138788
tomcat.apache.org/security-7.html
github.com/advisories/GHSA-r7c8-hghc-2mp8
github.com/apache/tomcat/commit/279e4451cb996f810fbca2f78b6340412d9daa7b
issues.apache.org/bugzilla/show_bug.cgi?id=51395
nvd.nist.gov/vuln/detail/CVE-2011-2481
web.archive.org/web/20111209022500/www.securityfocus.com/bid/49147
web.archive.org/web/20161127215021/securitytracker.com/id?1025924
Related
4.6 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
0.0004 Low
EPSS
Percentile
9.5%