Description

Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.

Remediation

References

CVE-2011-1419

Related Vulnerabilities

WordPress Plugin Powerplay Gallery Multiple Vulnerabilities (3.3)

WordPress Plugin WP Performance Score Booster-Optimize Speed, Enable Cache & Page Preload Cross-Site Request Forgery (2.0)

WordPress Plugin MainWP Child-Securely connects sites to the MainWP WordPress Manager Dashboard Security Bypass (3.4.4)

TYPO3 Improper Authentication Vulnerability (CVE-2009-3635)

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-7926)

Severity

Medium

Classification

CVE-2011-1419

Tags

Missing Update Known Vulnerabilities