{"id":"CVE-2011-1582","published":"2011-05-20T22:00:00Z","modified":"2024-08-06T22:28:41Z","title":"Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that…","vendor":null,"product":null,"tier":"tail","description":{"text":"Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.06016,"percentile":0.93315,"provenance":"source"},"cwes":[],"references":[{"url":"http://securityreason.com/securityalert/8256","tags":["third-party-advisory","x_refsource_SREASON"]},{"url":"http://www.securityfocus.com/archive/1/518032/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://mail-archives.apache.org/mod_mbox/www-announce/201105.mbox/%3C4DD26E30.2060103%40apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.vupen.com/english/advisories/2011/1255","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1100832","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/47886","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/67515","tags":["vdb-entry","x_refsource_XF"]},{"url":"http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.14_%28released_12_May_2011%29","tags":["x_refsource_CONFIRM"]}],"priority":{"score":18.7,"factors":[{"name":"EPSS percentile","points":18.66}]},"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=7.0.12, <7.0.14"],"patched":["7.0.14"],"from":["GHSA-3xpj-jgv5-q4vv"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-2261","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-tomcat-cve-2009-0783","parents":[{"from":"CVE-2011-1088","to":"CVE-2011-1582","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.","from":"CVE.org","in":"CVE-2011-1582"},{"kind":"same-code","provenance":"machine","files":["java/org/apache/catalina/core/StandardWrapper.java"],"commits":["https://github.com/apache/tomcat/commit/f528992ec6cd7b62c9ced5b3a7dc4cda6bfd1a5e","https://github.com/apache/tomcat/commit/ee627412570268df47a075f5d4dc5f7debf39fad","https://github.com/apache/tomcat/commit/299b26af66793438c323ea6b18462fa44683080f"],"basis":"shared file"},{"kind":"similar","provenance":"machine","score":0.39,"basis":"same package + description similarity"}]},{"from":"CVE-2011-1419","to":"CVE-2011-1582","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.","from":"CVE.org","in":"CVE-2011-1582"},{"kind":"same-code","provenance":"machine","files":["java/org/apache/catalina/core/StandardWrapper.java"],"commits":["https://github.com/apache/tomcat/commit/0ff4905158b77787a7f3aca55c9dec93456665dc","https://github.com/apache/tomcat/commit/3e5b0455483eed55752047073e92403bfca8d3ec","https://github.com/apache/tomcat/commit/299b26af66793438c323ea6b18462fa44683080f"],"basis":"shared file"},{"kind":"similar","provenance":"machine","score":0.58,"basis":"same package + description similarity"}]},{"from":"CVE-2011-1183","to":"CVE-2011-1582","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.","from":"CVE.org","in":"CVE-2011-1582"},{"kind":"similar","provenance":"machine","score":0.42,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2011-5062","published":"2012-01-14","fixed":"7.0.12","kev":false},{"cve":"CVE-2011-5063","published":"2012-01-14","fixed":"7.0.12","kev":false},{"cve":"CVE-2011-5064","published":"2012-01-14","fixed":"7.0.12","kev":false},{"cve":"CVE-2011-1582","published":"2011-05-20","fixed":"7.0.14","kev":false},{"cve":"CVE-2011-2481","published":"2011-08-15","fixed":"7.0.17","kev":false,"link":{"from":"CVE-2011-1582","to":"CVE-2011-2481","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"7.0.14","toFixed":"7.0.17","daysApart":87}]}},{"cve":"CVE-2011-2204","published":"2011-06-29","fixed":"7.0.19","kev":false},{"cve":"CVE-2011-2526","published":"2011-07-14","fixed":"7.0.19","kev":false}],"package":"Maven:org.apache.tomcat:tomcat"}}