CVE-2011-2481: Infoleak
Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2481?
CVE-2011-2481 is classified as a medium-severity vulnerability.
How do I fix CVE-2011-2481?
To fix CVE-2011-2481, upgrade Apache Tomcat to version 7.0.17 or later.
What type of vulnerability is CVE-2011-2481?
CVE-2011-2481 is an XML parser vulnerability that can allow local users to access or modify web application files.
Which versions of Apache Tomcat are affected by CVE-2011-2481?
CVE-2011-2481 affects all Apache Tomcat versions prior to 7.0.17.
Are any specific files at risk due to CVE-2011-2481?
CVE-2011-2481 allows unauthorized access to important configuration files such as web.xml, context.xml, and tld files.