Back to feed
EUVD-2022-5341 · Published May 17, 2022
Apache Tomcat does not follow ServletSecurity annotations Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.
Technologies
Apache Tomcat
Weaknesses
NVD-CWE-OtherCWE-284
References
- http://mail-archives.apache.org/mod_mbox/www-announce/201103.mbox/%3C4D6E74FF.7050106%40apache.org%3E
- http://marc.info/?l=tomcat-user&m=129966773405409&w=2
- http://markmail.org/message/lzx5273wsgl5pob6
- http://markmail.org/message/yzmyn44f5aetmm2r
- http://secunia.com/advisories/43684
- http://securityreason.com/securityalert/8131
Potentially impacted assets
See if this affects your attack surface
