CVE-2011-3376
First published: Fri Nov 11 2011(Updated: )
org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application, which allows local users to gain privileges by using an untrusted web application to access the Manager application's functionality.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Tomcat | =7.0.0 | |
| Tomcat | =7.0.0-beta | |
| Tomcat | =7.0.1 | |
| Tomcat | =7.0.2 | |
| Tomcat | =7.0.3 | |
| Tomcat | =7.0.4 | |
| Tomcat | =7.0.5 | |
| Tomcat | =7.0.6 | |
| Tomcat | =7.0.7 | |
| Tomcat | =7.0.8 | |
| Tomcat | =7.0.9 | |
| Tomcat | =7.0.10 | |
| Tomcat | =7.0.11 | |
| Tomcat | =7.0.12 | |
| Tomcat | =7.0.13 | |
| Tomcat | =7.0.14 | |
| Tomcat | =7.0.15 | |
| Tomcat | =7.0.16 | |
| Tomcat | =7.0.17 | |
| Tomcat | =7.0.18 | |
| Tomcat | =7.0.19 | |
| Tomcat | =7.0.20 | |
| Tomcat | =7.0.21 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2011-3376?
CVE-2011-3376 is rated as a medium severity vulnerability.
How do I fix CVE-2011-3376?
To fix CVE-2011-3376, upgrade Apache Tomcat to version 7.0.22 or later.
What software versions are affected by CVE-2011-3376?
CVE-2011-3376 affects Apache Tomcat versions from 7.0.0 to 7.0.21.
What type of vulnerability is CVE-2011-3376?
CVE-2011-3376 is a privilege escalation vulnerability in the Manager application of Apache Tomcat.
Can local users exploit CVE-2011-3376?
Yes, local users can exploit CVE-2011-3376 to gain unauthorized access to the Manager application's capabilities.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/apache
- canonical/tomcat
- version/tomcat/7.0.0
- version/tomcat/7.0.0-beta
- version/tomcat/7.0.1
- version/tomcat/7.0.2
- version/tomcat/7.0.3
- version/tomcat/7.0.4
- version/tomcat/7.0.5
- version/tomcat/7.0.6
- version/tomcat/7.0.7
- version/tomcat/7.0.8
- version/tomcat/7.0.9
- version/tomcat/7.0.10
- version/tomcat/7.0.11
- version/tomcat/7.0.12
- version/tomcat/7.0.13
- version/tomcat/7.0.14
- version/tomcat/7.0.15
- version/tomcat/7.0.16
- version/tomcat/7.0.17
- version/tomcat/7.0.18
- version/tomcat/7.0.19
- version/tomcat/7.0.20
- version/tomcat/7.0.21