medium4.4
CVE-2011-3376
org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application…
Impact
org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application, which allows local users to gain privileges by using an untrusted web application to access the Manager application's functionality.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Tomcat | Versions 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5 |
Weakness classification
References
- NVD record
- CVE.org record
- http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/core/DefaultInstanceManager.java?r1=1176588&r2=1176587&pathrev=1176588
- http://svn.apache.org/viewvc?view=revision&revision=1176588
- http://tomcat.apache.org/security-7.html
- http://www.securityfocus.com/bid/50603
- http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/core/DefaultInstanceManager.java?r1=1176588&r2=1176587&pathrev=1176588
- http://svn.apache.org/viewvc?view=revision&revision=1176588
- http://tomcat.apache.org/security-7.html
- http://www.securityfocus.com/bid/50603