« Volver al listado

CVE-2011-1419

Estado: ModificadaMedia (5.8)—

Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Tomcat

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2011-1419",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2011-03-14T19:55:02.637",
  "references": [
    {
      "url": "http://mail-archives.apache.org/mod_mbox/www-announce/201103.mbox/%3C4D6E74FF.7050106%40apache.org%3E",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://marc.info/?l=tomcat-user&m=129966773405409&w=2",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://markmail.org/message/lzx5273wsgl5pob6",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://markmail.org/message/yzmyn44f5aetmm2r",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/43684",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/8131",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://svn.apache.org/viewvc?view=revision&revision=1079752",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://tomcat.apache.org/security-7.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/71027",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/46685",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2011/0563",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65971",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66154",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://mail-archives.apache.org/mod_mbox/www-announce/201103.mbox/%3C4D6E74FF.7050106%40apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=tomcat-user&m=129966773405409&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://markmail.org/message/lzx5273wsgl5pob6",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://markmail.org/message/yzmyn44f5aetmm2r",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/43684",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/8131",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://svn.apache.org/viewvc?view=revision&revision=1079752",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://tomcat.apache.org/security-7.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/71027",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/46685",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2011/0563",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65971",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66154",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088."
    },
    {
      "lang": "es",
      "value": "Apache Tomcat v7.x anterior a v7.0.11, cuando web.xml no tiene restricciones de seguridad, no sigue anotaciones ServletSecurity, lo que permite a atacantes remotos evitar las restricciones de acceso a través de peticiones HTTP a una aplicación web. Nota: esta vulnerabilidad existe debido a un parche incompleto para CVE-2011-1088."
    }
  ],
  "lastModified": "2026-06-16T23:29:18.667",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0F8C62EF-1B67-456A-9C66-755439CF8556"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "33E9607B-4D28-460D-896B-E4B7FA22441E"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A819E245-D641-4F19-9139-6C940504F6E7"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C381275-10C5-4939-BCE3-0D1F3B3CB2EE"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7205475A-6D04-4042-B24E-1DA5A57029B7"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "08022987-B36B-4F63-88A5-A8F59195DF4A"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF4B7557-EF35-451E-B55D-3296966695AC"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8980E61E-27BE-4858-82B3-C0E8128AF521"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8756BF9B-3E24-4677-87AE-31CE776541F0"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "88CE057E-2092-4C98-8D0C-75CF439D0A9C"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F194580-EE6D-4E38-87F3-F0661262256B"
            },
            {
              "criteria": "cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9731BAA-4C6C-4259-B786-F577D8A90FA1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}