VDB
CVE-2011-3376
CVE-2011-3376
PUBLISHED
CVSS 4.400000095367432 MEDIUM
org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application, which allows local users to gain privileges by using an untrusted web application to access the Manager application's functionality.
EPSS 0.64% · 50.0th percentile
Risk Scores
CVSS 2.0
4.400000095367432
EPSS Score
0.64%
50.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| apache | tomcat | 7.0.21, 7.0.0, 7.0.0 |
| n/a | n/a | n/a |
Timeline
- Nov 11, 2011 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 30, 2022 EPSS Score
- May 22, 2022 EPSS Score
- Jul 16, 2022 EPSS Score
- Sep 7, 2022 EPSS Score
- Oct 31, 2022 EPSS Score
- Dec 23, 2022 EPSS Score
- Feb 15, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 9, 2023 EPSS Score
- Jun 2, 2023 EPSS Score
References
- http://tomcat.apache.org/security-7.html advisory
- http://www.securityfocus.com/bid/50603 technical
- http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/core/DefaultInstanceManager.java?r1=1176588&r2=1176587&pathrev=1176588 patch
- http://svn.apache.org/viewvc?view=revision&revision=1176588 technical
- https://nvd.nist.gov/vuln/detail/CVE-2011-3376 advisory