Apache TomcatTOMCAT:205164F0DDE6E8C98A7D7D1A06B0C529Fixed in Apache Tomcat 7.0.14
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.004 Low
EPSS
Percentile
71.7%
Important: Security constraint bypass CVE-2011-1582
An error in the fixes for CVE-2011-1088/CVE-2011-1183 meant that security constraints configured via annotations were ignored on the first request to a Servlet. Subsequent requests were secured correctly.
This was fixed in revision 1100832.
This was identified by the Tomcat security team on 13 April 2011 and made public on 17 May 2011.
Affects: 7.0.12-7.0.13
| CPE | Name | Operator | Version |
|---|---|---|---|
| apache tomcat | ge | 7.0.12 | |
| apache tomcat | le | 7.0.13 |
Related
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.004 Low
EPSS
Percentile
71.7%