Description

Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.

Remediation

References

CVE-2011-3190

Related Vulnerabilities

Joomla URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2015-5608)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-12156)

WordPress Plugin YouTube Embed Cross-Site Scripting (5.0.1)

PostgreSQL Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2019-9193)

WordPress Plugin Migration, Backup, Staging-WPvivid PHAR Deserialization (0.9.74)

Severity

High

Classification

CVE-2011-3190 CWE-264

Tags

Missing Update Known Vulnerabilities