{"id":"CVE-2011-3190","published":"2011-08-31T23:00:00Z","modified":"2024-08-06T23:29:55Z","title":"Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0…","vendor":null,"product":null,"tier":"tail","description":{"text":"Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.15226,"percentile":0.96753,"provenance":"source"},"cwes":[],"references":[{"url":"http://secunia.com/advisories/45748","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/69472","tags":["vdb-entry","x_refsource_XF"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2011:156","tags":["vendor-advisory","x_refsource_MANDRIVA"]},{"url":"http://www.debian.org/security/2012/dsa-2401","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://www.securitytracker.com/id?1025993","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://secunia.com/advisories/48308","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/49094","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://marc.info/?l=bugtraq&m=136485229118404&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.securityfocus.com/bid/49353","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://securityreason.com/securityalert/8362","tags":["third-party-advisory","x_refsource_SREASON"]},{"url":"http://marc.info/?l=bugtraq&m=133469267822771&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19465","tags":["vdb-entry","signature","x_refsource_OVAL"]},{"url":"http://marc.info/?l=bugtraq&m=132215163318824&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14933","tags":["vdb-entry","signature","x_refsource_OVAL"]},{"url":"http://secunia.com/advisories/57126","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.securityfocus.com/archive/1/519466/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"https://issues.apache.org/bugzilla/show_bug.cgi?id=51698","tags":["x_refsource_MISC"]},{"url":"http://marc.info/?l=bugtraq&m=139344343412337&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":19.4,"factors":[{"name":"EPSS percentile","points":19.35}]},"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=7.0.0, <7.0.21",">=6.0.0, <6.0.34",">=5.0.0, <5.5.34"],"patched":["7.0.21","6.0.34","5.5.34"],"from":["GHSA-c38m-v4m2-524v"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-3486","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-org-apache-tomcat-tomcat-cve-2005-2090","children":[{"from":"CVE-2011-3190","to":"CVE-2011-3375","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"7.0.21","toFixed":"7.0.22","daysApart":141},{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/ajp/AbstractAjpProcessor.java","java/org/apache/coyote/ajp/AjpAprProcessor.java","java/org/apache/coyote/ajp/AjpNioProcessor.java","java/org/apache/coyote/ajp/AjpProcessor.java"],"commits":["https://github.com/apache/tomcat/commit/a2538ce78f83b7376c48d12d8247600079d789b1","https://github.com/apache/tomcat/commit/9eae334e9492f55a841e6eb7ab302ff11d03ab21"],"basis":"shared function","functions":["process"]}]},{"from":"CVE-2011-3190","to":"CVE-2013-4286","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/ajp/AbstractAjpProcessor.java"],"commits":["https://github.com/apache/tomcat/commit/a2538ce78f83b7376c48d12d8247600079d789b1","https://github.com/apache/tomcat/commit/41b90b6ebc3e7f898a5a87d197ddf63790d33315","https://github.com/apache/tomcat/commit/7c040003f1387795356605566be7870cf70e05dc"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.36,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2011-2481","published":"2011-08-15","fixed":"7.0.17","kev":false},{"cve":"CVE-2011-2204","published":"2011-06-29","fixed":"7.0.19","kev":false},{"cve":"CVE-2011-2526","published":"2011-07-14","fixed":"7.0.19","kev":false,"link":{"from":"CVE-2011-2526","to":"CVE-2011-3190","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"7.0.19","toFixed":"7.0.21","daysApart":48}]}},{"cve":"CVE-2011-3190","published":"2011-08-31","fixed":"7.0.21","kev":false},{"cve":"CVE-2011-3375","published":"2012-01-19","fixed":"7.0.22","kev":false},{"cve":"CVE-2011-4858","published":"2012-01-05","fixed":"7.0.23","kev":false,"link":{"from":"CVE-2011-3190","to":"CVE-2011-4858","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"6.0.34","toFixed":"6.0.35","daysApart":127}]}},{"cve":"CVE-2012-0022","published":"2012-01-19","fixed":"7.0.23","kev":false}],"package":"Maven:org.apache.tomcat:tomcat"}}