CVE-2011-2481
published 2011-08-15CVE-2011-2481: Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify…
PriorityP417medium4.6CVSS 2.0
AVLACLAuNCPIPAP
EPSS
0.84%
53.8th percentile
Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
CVSS provenance
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
ghsa4.2MEDIUM
osv4.2MEDIUM
vendor_redhat4.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Apache Tomcat CVE-2009-0783 regression
vendor_redhat·2011-08-12·CVSS 4.2
CVE-2011-2481 [MEDIUM] Apache Tomcat CVE-2009-0783 regression
Apache Tomcat CVE-2009-0783 regression
Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
Statement: This issue did not affect any version of Tomcat shipped in Red Hat products. This flaw only affected Tomcat versions 7.0.0 - 7.0.16.
Package: tomcat5 (Red Hat Enterprise Linux 5) - Not affected
Package: tomcat6 (Red Hat Enterprise Linux 6) - Not affected
OSV
Apache Tomcat Allows Replacing of XML Parser
osv·2022-05-17·CVSS 4.2
CVE-2011-2481 [MEDIUM] Apache Tomcat Allows Replacing of XML Parser
Apache Tomcat Allows Replacing of XML Parser
Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
GHSA
Apache Tomcat Allows Replacing of XML Parser
ghsa·2022-05-17·CVSS 4.2
CVE-2011-2481 [MEDIUM] CWE-200 Apache Tomcat Allows Replacing of XML Parser
Apache Tomcat Allows Replacing of XML Parser
Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
No detection rules found.
No public exploits indexed.
http://marc.info/?l=bugtraq&m=139344343412337&w=2http://secunia.com/advisories/57126http://securitytracker.com/id?1025924http://svn.apache.org/viewvc?view=revision&revision=1137753http://svn.apache.org/viewvc?view=revision&revision=1138788http://tomcat.apache.org/security-7.htmlhttp://www.securityfocus.com/bid/49147https://issues.apache.org/bugzilla/show_bug.cgi?id=51395http://marc.info/?l=bugtraq&m=139344343412337&w=2http://secunia.com/advisories/57126http://securitytracker.com/id?1025924http://svn.apache.org/viewvc?view=revision&revision=1137753http://svn.apache.org/viewvc?view=revision&revision=1138788http://tomcat.apache.org/security-7.htmlhttp://www.securityfocus.com/bid/49147https://issues.apache.org/bugzilla/show_bug.cgi?id=51395
2011-08-15
Published