CVE-2011-1419
Apache Tomcat does not follow ServletSecurity annotations
EPSS 16.1%
Description
Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.
How to fix CVE-2011-1419
To remediate CVE-2011-1419, upgrade the affected package to a fixed version below.
- Maven/org.apache.tomcat:tomcat—upgrade to 7.0.11 or later
Is CVE-2011-1419 being exploited?
Moderate — EPSS is 16.1%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (1)
- >= 7.0, < 7.0.11