CVE-2011-1088: Undefined Security Weakness

Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application...

Apache Tomcat "@ServletSecurity" 注释安全限制绕过漏洞

CVE ID: CVE-2011-1088 Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Apache Tomcat在实现上存在"@ServletSecurity" 注释安全限制绕过漏洞，远程攻击者可利用此漏洞绕过某些安全限制。 由于应用程序在加载小服务程序时未能正确执行"@ServletSecurity" 注释，可通过绕过注释指定的安全限制并泄露某些信息。 Apache Group Tomcat 7.x 厂商补丁： Apache Group ------------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

PT-2011-2861 · Apache · Apache Tomcat

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 7.0.0 through 7.0.10 Description: The issue allows remote attackers to bypass intended access restrictions via HTTP requests to a web application because Apache Tomcat does not follow ServletSecurity annotations. This...

Fixed in Apache Tomcat 7.0.11

Important: Security constraint bypass CVE-2011-1088 When a web application was started, ServletSecurity annotations were ignored. This meant that some areas of the application may not have been protected as expected. This was partially fixed in Apache Tomcat 7.0.10 and fully fixed in 7.0.11. This...

Apache Tomcat 7.0.x < 7.0.11 Security Bypass Vulnerability

Binary data 5816.pasl...