CVE-2011-3376: Medium severity tomcat vulnerability
Published Nov 11, 2011
·Updated
org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application, which allows local users to gain privileges by using an untrusted web application to access the Manager application's functionality.
Affected Software
23 affected components
Apache Tomcat=7.0.0
Apache Tomcat=7.0.0-beta
Apache Tomcat=7.0.1
Apache Tomcat=7.0.2
Apache Tomcat=7.0.3
Apache Tomcat=7.0.4
Apache Tomcat=7.0.5
Apache Tomcat=7.0.6
Apache Tomcat=7.0.7
Apache Tomcat=7.0.8
Apache Tomcat=7.0.9
Apache Tomcat=7.0.10
Apache Tomcat=7.0.11
Apache Tomcat=7.0.12
Apache Tomcat=7.0.13
Apache Tomcat=7.0.14
Apache Tomcat=7.0.15
Apache Tomcat=7.0.16
Apache Tomcat=7.0.17
Apache Tomcat=7.0.18
Apache Tomcat=7.0.19
Apache Tomcat=7.0.20
Apache Tomcat=7.0.21
Remediation
Event History
Nov 11, 2011
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-3376?
CVE-2011-3376 is rated as a medium severity vulnerability.
2
How do I fix CVE-2011-3376?
To fix CVE-2011-3376, upgrade Apache Tomcat to version 7.0.22 or later.
3
What software versions are affected by CVE-2011-3376?
CVE-2011-3376 affects Apache Tomcat versions from 7.0.0 to 7.0.21.
4
What type of vulnerability is CVE-2011-3376?
CVE-2011-3376 is a privilege escalation vulnerability in the Manager application of Apache Tomcat.
5
Can local users exploit CVE-2011-3376?
Yes, local users can exploit CVE-2011-3376 to gain unauthorized access to the Manager application's capabilities.