CVE-2011-2481
4.6 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
4.5 Medium
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
17.9%
Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
Affected configurations
References
marc.info/?l=bugtraq&m=139344343412337&w=2
secunia.com/advisories/57126
securitytracker.com/id?1025924
svn.apache.org/viewvc?view=revision&revision=1137753
svn.apache.org/viewvc?view=revision&revision=1138788
tomcat.apache.org/security-7.html
www.securityfocus.com/bid/49147
issues.apache.org/bugzilla/show_bug.cgi?id=51395
Related
4.6 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
4.5 Medium
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
17.9%