Vulnerability-Lookup

GHSA-VCH7-92VF-JM44

Vulnerability from github – Published: 2022-05-17 02:00 – Updated: 2024-01-19 19:29

Summary

Apache Tomcat does not follow ServletSecurity annotations

Details

Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0"
            },
            {
              "fixed": "7.0.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2011-1419"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-19T19:29:42Z",
    "nvd_published_at": "2011-03-14T19:55:00Z",
    "severity": "MODERATE"
  },
  "details": "Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.",
  "id": "GHSA-vch7-92vf-jm44",
  "modified": "2024-01-19T19:29:42Z",
  "published": "2022-05-17T02:00:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1419"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/commit/0ff4905158b77787a7f3aca55c9dec93456665dc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/commit/3e5b0455483eed55752047073e92403bfca8d3ec"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65971"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66154"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/tomcat"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20110307182442/http://markmail.org/message/yzmyn44f5aetmm2r"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20110323002552/http://markmail.org/message/lzx5273wsgl5pob6"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20170202135440/http://www.securityfocus.com/bid/46685"
    },
    {
      "type": "WEB",
      "url": "http://mail-archives.apache.org/mod_mbox/www-announce/201103.mbox/%3C4D6E74FF.7050106@apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=tomcat-user\u0026m=129966773405409\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1079752"
    },
    {
      "type": "WEB",
      "url": "http://tomcat.apache.org/security-7.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Apache Tomcat does not follow ServletSecurity annotations"
}

CVE-2011-1419 (GCVE-0-2011-1419)

Vulnerability from cvelistv5 – Published: 2011-03-14 19:00 – Updated: 2024-08-06 22:28

Summary

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
	http://secunia.com/advisories/43684	third-party-advisoryx_refsource_SECUNIA
	http://www.securityfocus.com/bid/46685	vdb-entryx_refsource_BID
	http://www.vupen.com/english/advisories/2011/0563	vdb-entryx_refsource_VUPEN
	http://tomcat.apache.org/security-7.html	x_refsource_CONFIRM
	http://securityreason.com/securityalert/8131	third-party-advisoryx_refsource_SREASON
	https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
	http://www.osvdb.org/71027	vdb-entryx_refsource_OSVDB
	http://mail-archives.apache.org/mod_mbox/www-anno…	mailing-listx_refsource_MLIST
	http://svn.apache.org/viewvc?view=revision&revisi…	x_refsource_CONFIRM
	http://markmail.org/message/lzx5273wsgl5pob6	mailing-listx_refsource_MLIST
	http://markmail.org/message/yzmyn44f5aetmm2r	mailing-listx_refsource_MLIST
	http://marc.info/?l=tomcat-user&m=129966773405409&w=2	mailing-listx_refsource_MLIST

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T22:28:40.816Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "tomcat-servletsecurity-sec-bypass(65971)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65971"
          },
          {
            "name": "43684",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/43684"
          },
          {
            "name": "46685",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/46685"
          },
          {
            "name": "ADV-2011-0563",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2011/0563"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-7.html"
          },
          {
            "name": "8131",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/8131"
          },
          {
            "name": "apache-servletsecurity-sec-bypass(66154)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66154"
          },
          {
            "name": "71027",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/71027"
          },
          {
            "name": "[announce] 20110302 [SECURITY] Tomcat 7 ignores @ServletSecurity annotations",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://mail-archives.apache.org/mod_mbox/www-announce/201103.mbox/%3C4D6E74FF.7050106%40apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1079752"
          },
          {
            "name": "[users] 20110302 Re: @DenyAll does nothing",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://markmail.org/message/lzx5273wsgl5pob6"
          },
          {
            "name": "[users] 20110302 Re: @DenyAll does nothing",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://markmail.org/message/yzmyn44f5aetmm2r"
          },
          {
            "name": "[users] 20110309 [SECURITY] Tomcat 7 ignores @ServletSecurity annotations",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=tomcat-user\u0026m=129966773405409\u0026w=2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-03-09T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-16T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "tomcat-servletsecurity-sec-bypass(65971)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65971"
        },
        {
          "name": "43684",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/43684"
        },
        {
          "name": "46685",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/46685"
        },
        {
          "name": "ADV-2011-0563",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2011/0563"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-7.html"
        },
        {
          "name": "8131",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/8131"
        },
        {
          "name": "apache-servletsecurity-sec-bypass(66154)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66154"
        },
        {
          "name": "71027",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/71027"
        },
        {
          "name": "[announce] 20110302 [SECURITY] Tomcat 7 ignores @ServletSecurity annotations",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://mail-archives.apache.org/mod_mbox/www-announce/201103.mbox/%3C4D6E74FF.7050106%40apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1079752"
        },
        {
          "name": "[users] 20110302 Re: @DenyAll does nothing",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://markmail.org/message/lzx5273wsgl5pob6"
        },
        {
          "name": "[users] 20110302 Re: @DenyAll does nothing",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://markmail.org/message/yzmyn44f5aetmm2r"
        },
        {
          "name": "[users] 20110309 [SECURITY] Tomcat 7 ignores @ServletSecurity annotations",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://marc.info/?l=tomcat-user\u0026m=129966773405409\u0026w=2"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-1419",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "tomcat-servletsecurity-sec-bypass(65971)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65971"
            },
            {
              "name": "43684",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/43684"
            },
            {
              "name": "46685",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/46685"
            },
            {
              "name": "ADV-2011-0563",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2011/0563"
            },
            {
              "name": "http://tomcat.apache.org/security-7.html",
              "refsource": "CONFIRM",
              "url": "http://tomcat.apache.org/security-7.html"
            },
            {
              "name": "8131",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/8131"
            },
            {
              "name": "apache-servletsecurity-sec-bypass(66154)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66154"
            },
            {
              "name": "71027",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/71027"
            },
            {
              "name": "[announce] 20110302 [SECURITY] Tomcat 7 ignores @ServletSecurity annotations",
              "refsource": "MLIST",
              "url": "http://mail-archives.apache.org/mod_mbox/www-announce/201103.mbox/%3C4D6E74FF.7050106@apache.org%3E"
            },
            {
              "name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1079752",
              "refsource": "CONFIRM",
              "url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1079752"
            },
            {
              "name": "[users] 20110302 Re: @DenyAll does nothing",
              "refsource": "MLIST",
              "url": "http://markmail.org/message/lzx5273wsgl5pob6"
            },
            {
              "name": "[users] 20110302 Re: @DenyAll does nothing",
              "refsource": "MLIST",
              "url": "http://markmail.org/message/yzmyn44f5aetmm2r"
            },
            {
              "name": "[users] 20110309 [SECURITY] Tomcat 7 ignores @ServletSecurity annotations",
              "refsource": "MLIST",
              "url": "http://marc.info/?l=tomcat-user\u0026m=129966773405409\u0026w=2"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-1419",
    "datePublished": "2011-03-14T19:00:00",
    "dateReserved": "2011-03-14T00:00:00",
    "dateUpdated": "2024-08-06T22:28:40.816Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-VCH7-92VF-JM44

CVE-2011-1419 (GCVE-0-2011-1419)

Tags

Sightings

Nomenclature