Patchfirst
Patchfirst
ChainApache TomcatMaven:org.apache.tomcat:tomcat

Apache Tomcat: incomplete fixes (2009–2023)

9 CVEs over 5 generations, 5 Jun 2009 to 22 Mar 2023.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2009-07835 Jun 2009 First in the chain
  2. CVE-2011-108814 Mar 2011 No direct link to an earlier CVE
  3. CVE-2011-141914 Mar 2011 incomplete fix for CVE-2011-1088
  4. CVE-2011-11838 Apr 2011 incomplete fix for CVE-2011-1088incomplete fix for CVE-2011-1419
  5. CVE-2011-158220 May 2011 incomplete fix for CVE-2011-1088incomplete fix for CVE-2011-1419and 1 more
  6. CVE-2011-248115 Aug 2011 regression of CVE-2009-0783next fix after CVE-2011-1582
  7. CVE-2013-459026 Feb 2014 related to CVE-2011-1088related to CVE-2011-1183
  8. CVE-2018-130523 Feb 2018 related to CVE-2011-1088related to CVE-2011-1183and 2 more
  9. CVE-2023-2870822 Mar 2023 related to CVE-2013-4590
200920102011201220132014201520162017201820202023 CVE-2009-0783 → CVE-2011-2481: regression of (high confidence)CVE-2011-1088 → CVE-2011-1183: incomplete fix (high confidence)CVE-2011-1088 → CVE-2011-1419: incomplete fix (high confidence)CVE-2011-1088 → CVE-2011-1582: incomplete fix (high confidence)CVE-2011-1419 → CVE-2011-1183: incomplete fix (high confidence)CVE-2011-1419 → CVE-2011-1582: incomplete fix (high confidence)CVE-2011-1183 → CVE-2011-1582: incomplete fix (high confidence)CVE-2011-1088 → CVE-2013-4590: related (medium confidence)CVE-2011-1088 → CVE-2018-1305: related (medium confidence)CVE-2011-1183 → CVE-2013-4590: related (medium confidence)CVE-2011-1183 → CVE-2018-1305: related (medium confidence)CVE-2011-2481 → CVE-2018-1305: related (medium confidence)CVE-2013-4590 → CVE-2018-1305: related (medium confidence)CVE-2013-4590 → CVE-2023-28708: related (medium confidence)CVE-2011-1582 → CVE-2011-2481: Next fix in the same package (low confidence) CVE-2009-0783 5 Jun 2009 CVE-2011-1088 14 Mar 2011 CVE-2011-1419 14 Mar 2011 CVE-2011-1183 8 Apr 2011 CVE-2011-1582 20 May 2011 CVE-2011-2481 15 Aug 2011 CVE-2013-4590 26 Feb 2014 CVE-2018-1305 23 Feb 2018 CVE-2023-28708 22 Mar 2023 200920102011201220132014201520162017201820192020202120222023 CVE-2009-0783 → CVE-2011-2481: regression of (high confidence)CVE-2011-1088 → CVE-2011-1183: incomplete fix (high confidence)CVE-2011-1088 → CVE-2011-1419: incomplete fix (high confidence)CVE-2011-1088 → CVE-2011-1582: incomplete fix (high confidence)CVE-2011-1419 → CVE-2011-1183: incomplete fix (high confidence)CVE-2011-1419 → CVE-2011-1582: incomplete fix (high confidence)CVE-2011-1183 → CVE-2011-1582: incomplete fix (high confidence)CVE-2011-1088 → CVE-2013-4590: related (medium confidence)CVE-2011-1088 → CVE-2018-1305: related (medium confidence)CVE-2011-1183 → CVE-2013-4590: related (medium confidence)CVE-2011-1183 → CVE-2018-1305: related (medium confidence)CVE-2011-2481 → CVE-2018-1305: related (medium confidence)CVE-2013-4590 → CVE-2018-1305: related (medium confidence)CVE-2013-4590 → CVE-2023-28708: related (medium confidence)CVE-2011-1582 → CVE-2011-2481: Next fix in the same package (low confidence) CVE-2009-0783 5 Jun 2009 CVE-2011-1088 14 Mar 2011 CVE-2011-1419 14 Mar 2011 CVE-2011-1183 8 Apr 2011 CVE-2011-1582 20 May 2011 CVE-2011-2481 15 Aug 2011 CVE-2013-4590 26 Feb 2014 CVE-2018-1305 23 Feb 2018 CVE-2023-28708 22 Mar 2023
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2009-0783 5 Jun 2009 Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace… · fixed in 6.0.20 First in chain 11.4
CVE-2011-1088 14 Mar 2011 Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass… · fixed in 7.0.10 First in chain 18.7
CVE-2011-1419 14 Mar 2011 Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity… · fixed in 7.0.11 CVE-2011-1088 · incomplete fix · High 18.8
CVE-2011-1183 8 Apr 2011 Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows… · fixed in 7.0.12 CVE-2011-1088 · incomplete fix · High 18.7
CVE-2011-1582 20 May 2011 Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that… · fixed in 7.0.14 CVE-2011-1088 · incomplete fix · High 18.7
CVE-2011-2481 15 Aug 2011 Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications… · fixed in 7.0.17 CVE-2009-0783 · regression of · High 11.6
CVE-2013-4590 26 Feb 2014 Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat… · fixed in 8.0.0-RC10 CVE-2011-1088 · related · Medium 19.1
CVE-2018-1305 23 Feb 2018 Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1… · fixed in 9.0.5 CVE-2011-1088 · related · Medium 24.3
CVE-2023-28708 22 Mar 2023 Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations · fixed in 11.0.0-M3 CVE-2013-4590 · related · Medium 18.8
↑ ↓ chooseEnter openEsc close