CVE Vulnerabilities

CVE-2011-3376

Published: Nov 11, 2011 | Modified: May 23, 2017
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
4.4 MEDIUM
AV:L/AC:M/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application, which allows local users to gain privileges by using an untrusted web application to access the Manager applications functionality.

Affected Software

Name Vendor Start Version End Version
Tomcat Apache 7.0.12 7.0.12
Tomcat Apache 7.0.20 7.0.20
Tomcat Apache 7.0.8 7.0.8
Tomcat Apache 7.0.1 7.0.1
Tomcat Apache 7.0.2 7.0.2
Tomcat Apache 7.0.5 7.0.5
Tomcat Apache 7.0.0 7.0.0
Tomcat Apache 7.0.6 7.0.6
Tomcat Apache 7.0.18 7.0.18
Tomcat Apache 7.0.14 7.0.14
Tomcat Apache 7.0.11 7.0.11
Tomcat Apache 7.0.0 7.0.0
Tomcat Apache 7.0.7 7.0.7
Tomcat Apache 7.0.13 7.0.13
Tomcat Apache 7.0.15 7.0.15
Tomcat Apache 7.0.19 7.0.19
Tomcat Apache 7.0.16 7.0.16
Tomcat Apache 7.0.10 7.0.10
Tomcat Apache 7.0.21 7.0.21
Tomcat Apache 7.0.17 7.0.17
Tomcat Apache 7.0.9 7.0.9
Tomcat Apache 7.0.4 7.0.4
Tomcat Apache 7.0.3 7.0.3

References