CVE-2011-1183: Medium severity tomcat vulnerability

Published Apr 8, 2011

Updated

Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1088 and CVE-2011-1419.

Affected Software

2 affected componentsFixes available

maven/org.apache.tomcat:tomcat=7.0.11

7.0.12

Apache Tomcat=7.0.11

Remediation

Patch Available

http://svn.apache.org/viewvc?view=revision&revision=1087643

Event History

Apr 8, 2011

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

May 14, 2022

Advisory Published

via GitHub·02:56 AM

Frequently Asked Questions

What is the severity of CVE-2011-1183?

CVE-2011-1183 is classified as a medium severity vulnerability that permits unauthorized access to web applications.

How do I fix CVE-2011-1183?

To fix CVE-2011-1183, upgrade Apache Tomcat to version 7.0.12 or later where the issue is resolved.

What is the impact of CVE-2011-1183?

The impact of CVE-2011-1183 allows remote attackers to bypass access restrictions due to the lack of login configuration in web.xml.

Which versions of Apache Tomcat are affected by CVE-2011-1183?

Apache Tomcat version 7.0.11 is specifically affected by CVE-2011-1183.

Is CVE-2011-1183 fixed in future versions of Apache Tomcat?

Yes, CVE-2011-1183 is addressed in Apache Tomcat version 7.0.12 and later.