CVE-2011-1582

Severity Score

4.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.

Apache Tomcat v7.0.12 y v7.0.13 procesa la primera petición a un servlet sin seguir las restricciones de seguridad que se han configurado a través de anotaciones, que permite a atacantes remotos evitar las restricciones de acceso previstas a través de peticiones HTTP. NOTA: esta vulnerabilidad existe debido a una solución incompleta para CVE-2011-1088, CVE-2011-1183, y CVE-2011-1419.

*Credits: N/A

CVSS Scores

NISTv2 4.3

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2011-04-05 CVE Reserved
2011-05-18 CVE Published
2023-03-07 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-264: Permissions, Privileges, and Access Controls

CAPEC

References (8)

URL	Tag	Source
http://mail-archives.apache.org/mod_mbox/www-announce/201105.mbox/%3C4DD26E30.2060103%40apache.org%3E	Mailing List
http://securityreason.com/securityalert/8256	Third Party Advisory
http://www.securityfocus.com/archive/1/518032/100/0/threaded	Mailing List
https://exchange.xforce.ibmcloud.com/vulnerabilities/67515	Vdb Entry

URL	Date	SRC

URL	Date	SRC
http://svn.apache.org/viewvc?view=revision&revision=1100832	2023-11-07
http://www.securityfocus.com/bid/47886	2023-11-07

URL	Date	SRC
http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.14_%28released_12_May_2011%29	2023-11-07
http://www.vupen.com/english/advisories/2011/1255	2023-11-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				7.0.12 Search vendor "Apache" for product "Tomcat" and version "7.0.12"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				7.0.13 Search vendor "Apache" for product "Tomcat" and version "7.0.13"		-		Affected