CVE-2011-2481

Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.

CVSS v2.0 4.6 MEDIUM

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://issues.apache.org/bugzilla/show_bug.cgi?id=51395	Exploit
http://svn.apache.org/viewvc?view=revision&revision=1138788	Patch
http://svn.apache.org/viewvc?view=revision&revision=1137753	Patch
http://securitytracker.com/id?1025924
http://tomcat.apache.org/security-7.html	Patch Vendor Advisory
http://marc.info/?l=bugtraq&m=139344343412337&w=2
http://secunia.com/advisories/57126
http://www.securityfocus.com/bid/49147

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:tomcat:7.0.12:::::::*
	cpe:2.3:a:apache:tomcat:7.0.8:::::::*
	cpe:2.3:a:apache:tomcat:7.0.1:::::::*
	cpe:2.3:a:apache:tomcat:7.0.2:::::::*
	cpe:2.3:a:apache:tomcat:7.0.5:::::::*
	cpe:2.3:a:apache:tomcat:7.0.0:::::::*
	cpe:2.3:a:apache:tomcat:7.0.6:::::::*
	cpe:2.3:a:apache:tomcat:7.0.14:::::::*
	cpe:2.3:a:apache:tomcat:7.0.11:::::::*
	cpe:2.3:a:apache:tomcat:7.0.0:beta::::::
	cpe:2.3:a:apache:tomcat:7.0.7:::::::*
	cpe:2.3:a:apache:tomcat:7.0.13:::::::*
	cpe:2.3:a:apache:tomcat:7.0.10:::::::*
	cpe:2.3:a:apache:tomcat:7.0.9:::::::*
	cpe:2.3:a:apache:tomcat:7.0.4:::::::*
	cpe:2.3:a:apache:tomcat:7.0.3:::::::*

Information

Published : 2011-08-15 14:55

Updated : 2023-02-12 20:31

NVD link : CVE-2011-2481

Mitre link : CVE-2011-2481

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

apache

tomcat

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=51395", "name": "https://issues.apache.org/bugzilla/show_bug.cgi?id=51395", "tags": ["Exploit"], "refsource": "CONFIRM"}, {"url": "http://svn.apache.org/viewvc?view=revision&revision=1138788", "name": "http://svn.apache.org/viewvc?view=revision&revision=1138788", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://svn.apache.org/viewvc?view=revision&revision=1137753", "name": "http://svn.apache.org/viewvc?view=revision&revision=1137753", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://securitytracker.com/id?1025924", "name": "1025924", "tags": [], "refsource": "SECTRACK"}, {"url": "http://tomcat.apache.org/security-7.html", "name": "http://tomcat.apache.org/security-7.html", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://marc.info/?l=bugtraq&m=139344343412337&w=2", "name": "HPSBST02955", "tags": [], "refsource": "HP"}, {"url": "http://secunia.com/advisories/57126", "name": "57126", "tags": [], "refsource": "SECUNIA"}, {"url": "http://www.securityfocus.com/bid/49147", "name": "49147", "tags": [], "refsource": "BID"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2011-2481", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2011-08-15T21:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2023-02-13T04:31Z"}