{"id":"CVE-2011-1088","published":"2011-03-14T19:00:00Z","modified":"2024-08-06T22:14:27Z","title":"Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass…","vendor":null,"product":null,"tier":"tail","description":{"text":"Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.06453,"percentile":0.93708,"provenance":"source"},"cwes":[],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/65971","tags":["vdb-entry","x_refsource_XF"]},{"url":"http://www.securityfocus.com/archive/1/517013/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://secunia.com/advisories/43684","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.securityfocus.com/bid/46685","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.vupen.com/english/advisories/2011/0563","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://tomcat.apache.org/security-7.html","tags":["x_refsource_CONFIRM"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1076587","tags":["x_refsource_CONFIRM"]},{"url":"http://www.osvdb.org/71027","tags":["vdb-entry","x_refsource_OSVDB"]},{"url":"http://www.securitytracker.com/id?1025215","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://mail-archives.apache.org/mod_mbox/www-announce/201103.mbox/%3C4D6E74FF.7050106%40apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1076586","tags":["x_refsource_CONFIRM"]},{"url":"http://markmail.org/message/lzx5273wsgl5pob6","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1077995","tags":["x_refsource_CONFIRM"]},{"url":"http://markmail.org/message/yzmyn44f5aetmm2r","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":18.7,"factors":[{"name":"EPSS percentile","points":18.74}]},"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=7.0.0, <7.0.10"],"patched":["7.0.10"],"from":["GHSA-mg4v-rf8p-ghqq"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-4557","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-tomcat-cve-2009-0783","children":[{"from":"CVE-2011-1088","to":"CVE-2011-1183","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1088 and CVE-2011-1419.","from":"CVE.org","in":"CVE-2011-1183"},{"kind":"same-code","provenance":"machine","files":["java/org/apache/catalina/authenticator/AuthenticatorBase.java","java/org/apache/catalina/core/StandardContext.java"],"commits":["https://github.com/apache/tomcat/commit/f528992ec6cd7b62c9ced5b3a7dc4cda6bfd1a5e","https://github.com/apache/tomcat/commit/ee627412570268df47a075f5d4dc5f7debf39fad","https://github.com/apache/tomcat/commit/b7b5c63a932f6c1ea05f9b65ad9054247bb5af57"],"basis":"shared function","functions":["StandardContext","invoke"]},{"kind":"similar","provenance":"machine","score":0.38,"basis":"same package + description similarity"}]},{"from":"CVE-2011-1088","to":"CVE-2011-1419","relation":"incomplete-fix","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.","from":"CVE.org","in":"CVE-2011-1419"},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"7.0.10","toFixed":"7.0.11","daysApart":0},{"kind":"same-code","provenance":"machine","files":["java/org/apache/catalina/core/StandardWrapper.java"],"commits":["https://github.com/apache/tomcat/commit/f528992ec6cd7b62c9ced5b3a7dc4cda6bfd1a5e","https://github.com/apache/tomcat/commit/ee627412570268df47a075f5d4dc5f7debf39fad","https://github.com/apache/tomcat/commit/0ff4905158b77787a7f3aca55c9dec93456665dc","https://github.com/apache/tomcat/commit/3e5b0455483eed55752047073e92403bfca8d3ec"],"basis":"shared file"},{"kind":"similar","provenance":"machine","score":0.84,"basis":"same package + description similarity"}]},{"from":"CVE-2011-1088","to":"CVE-2011-1582","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.","from":"CVE.org","in":"CVE-2011-1582"},{"kind":"same-code","provenance":"machine","files":["java/org/apache/catalina/core/StandardWrapper.java"],"commits":["https://github.com/apache/tomcat/commit/f528992ec6cd7b62c9ced5b3a7dc4cda6bfd1a5e","https://github.com/apache/tomcat/commit/ee627412570268df47a075f5d4dc5f7debf39fad","https://github.com/apache/tomcat/commit/299b26af66793438c323ea6b18462fa44683080f"],"basis":"shared file"},{"kind":"similar","provenance":"machine","score":0.39,"basis":"same package + description similarity"}]},{"from":"CVE-2011-1088","to":"CVE-2013-4590","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/catalina/core/StandardContext.java"],"commits":["https://github.com/apache/tomcat/commit/f528992ec6cd7b62c9ced5b3a7dc4cda6bfd1a5e","https://github.com/apache/tomcat/commit/ee627412570268df47a075f5d4dc5f7debf39fad","https://github.com/apache/tomcat/commit/05c84ff8304a69a30b251f207a7b93c2c882564d","https://github.com/apache/tomcat/commit/78dd7e6f3d8481bc3bcd71ca5b20296de1283888"],"basis":"shared function","functions":["StandardContext"]}]},{"from":"CVE-2011-1088","to":"CVE-2018-1305","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/catalina/Wrapper.java","java/org/apache/catalina/authenticator/AuthenticatorBase.java","java/org/apache/catalina/core/StandardContext.java","java/org/apache/catalina/core/StandardWrapper.java"],"commits":["https://github.com/apache/tomcat/commit/f528992ec6cd7b62c9ced5b3a7dc4cda6bfd1a5e","https://github.com/apache/tomcat/commit/ee627412570268df47a075f5d4dc5f7debf39fad","https://github.com/apache/tomcat/commit/2349801827f09fb6582a8afdeca704294106ad9a","https://github.com/apache/tomcat/commit/2aac69f694d42d9219eb27018b3da0ae1bdd73ab"],"basis":"shared function","functions":["StandardWrapper","getRealPath","invoke","loadServlet","setMultipartConfigElement"]}]}],"packageHistory":[{"cve":"CVE-2010-4476","published":"2011-02-17","fixed":"7.0.7","kev":false},{"cve":"CVE-2011-0534","published":"2011-02-10","fixed":"7.0.8","kev":false,"link":{"from":"CVE-2011-0534","to":"CVE-2011-1088","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"7.0.8","toFixed":"7.0.10","daysApart":32}]}},{"cve":"CVE-2009-3555","published":"2009-11-09","fixed":"7.0.10","kev":false},{"cve":"CVE-2011-1088","published":"2011-03-14","fixed":"7.0.10","kev":false},{"cve":"CVE-2011-1419","published":"2011-03-14","fixed":"7.0.11","kev":false},{"cve":"CVE-2011-1183","published":"2011-04-08","fixed":"7.0.12","kev":false},{"cve":"CVE-2011-1184","published":"2012-01-14","fixed":"7.0.12","kev":false}],"package":"Maven:org.apache.tomcat:tomcat"}}