{"id":"CVE-2011-1183","published":"2011-04-08T15:00:00Z","modified":"2024-08-06T22:21:33Z","title":"Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows…","vendor":null,"product":null,"tier":"tail","description":{"text":"Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1088 and CVE-2011-1419.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.06156,"percentile":0.9345,"provenance":"source"},"cwes":[],"references":[{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12701","tags":["vdb-entry","signature","x_refsource_OVAL"]},{"url":"http://www.securityfocus.com/bid/47196","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://tomcat.apache.org/security-7.html","tags":["x_refsource_CONFIRM"]},{"url":"http://securityreason.com/securityalert/8187","tags":["third-party-advisory","x_refsource_SREASON"]},{"url":"http://seclists.org/fulldisclosure/2011/Apr/96","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://www.securityfocus.com/archive/1/517362/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1087643","tags":["x_refsource_CONFIRM"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/66675","tags":["vdb-entry","x_refsource_XF"]}],"priority":{"score":18.7,"factors":[{"name":"EPSS percentile","points":18.69}]},"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=7.0.11, <7.0.12"],"patched":["7.0.12"],"from":["GHSA-p26v-97vp-jcx6"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-4656","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-tomcat-cve-2009-0783","parents":[{"from":"CVE-2011-1088","to":"CVE-2011-1183","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1088 and CVE-2011-1419.","from":"CVE.org","in":"CVE-2011-1183"},{"kind":"same-code","provenance":"machine","files":["java/org/apache/catalina/authenticator/AuthenticatorBase.java","java/org/apache/catalina/core/StandardContext.java"],"commits":["https://github.com/apache/tomcat/commit/f528992ec6cd7b62c9ced5b3a7dc4cda6bfd1a5e","https://github.com/apache/tomcat/commit/ee627412570268df47a075f5d4dc5f7debf39fad","https://github.com/apache/tomcat/commit/b7b5c63a932f6c1ea05f9b65ad9054247bb5af57"],"basis":"shared function","functions":["StandardContext","invoke"]},{"kind":"similar","provenance":"machine","score":0.38,"basis":"same package + description similarity"}]},{"from":"CVE-2011-1419","to":"CVE-2011-1183","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1088 and CVE-2011-1419.","from":"CVE.org","in":"CVE-2011-1183"},{"kind":"same-code","provenance":"machine","files":["java/org/apache/catalina/startup/ContextConfig.java"],"commits":["https://github.com/apache/tomcat/commit/b7b5c63a932f6c1ea05f9b65ad9054247bb5af57","https://github.com/apache/tomcat/commit/0ff4905158b77787a7f3aca55c9dec93456665dc","https://github.com/apache/tomcat/commit/3e5b0455483eed55752047073e92403bfca8d3ec"],"basis":"shared function","functions":["applicationAnnotationsConfig"]},{"kind":"similar","provenance":"machine","score":0.59,"basis":"same package + description similarity"}]}],"children":[{"from":"CVE-2011-1183","to":"CVE-2011-1582","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.","from":"CVE.org","in":"CVE-2011-1582"},{"kind":"similar","provenance":"machine","score":0.42,"basis":"same package + description similarity"}]},{"from":"CVE-2011-1183","to":"CVE-2013-4590","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/catalina/Context.java","java/org/apache/catalina/core/StandardContext.java"],"commits":["https://github.com/apache/tomcat/commit/b7b5c63a932f6c1ea05f9b65ad9054247bb5af57","https://github.com/apache/tomcat/commit/05c84ff8304a69a30b251f207a7b93c2c882564d","https://github.com/apache/tomcat/commit/78dd7e6f3d8481bc3bcd71ca5b20296de1283888"],"basis":"shared function","functions":["StandardContext"]}]},{"from":"CVE-2011-1183","to":"CVE-2018-1305","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/catalina/authenticator/AuthenticatorBase.java","java/org/apache/catalina/core/StandardContext.java"],"commits":["https://github.com/apache/tomcat/commit/b7b5c63a932f6c1ea05f9b65ad9054247bb5af57","https://github.com/apache/tomcat/commit/2349801827f09fb6582a8afdeca704294106ad9a","https://github.com/apache/tomcat/commit/2aac69f694d42d9219eb27018b3da0ae1bdd73ab"],"basis":"shared function","functions":["invoke"]}]}]}}