Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not…
Priority LOW 35CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Partial · Partial · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-284.
Summary
Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.
Why it matters now
EPSS 0.0654 93rd percentileScored 2026-11-07
Fix Fixed org.apache.tomcat:tomcat (Maven): 7.0.11
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat (Maven) | 7.0 to before 7.0.11 | 7.0.11 | Patch available | GHSA-vch7-92vf-jm44 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 7.0 to before 7.0.11 Fixed in 7.0.11 Patch available GHSA-vch7-92vf-jm44
CPE configurations NVD · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:* | 7.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:* | 7.0.0 beta | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:* | 7.0.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:* | 7.0.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:* | 7.0.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:* | 7.0.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:* | 7.0.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:* | 7.0.6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:* | 7.0.7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:* | 7.0.8 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:* Versions 7.0.0 beta Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:* Versions 7.0.1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:* Versions 7.0.2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:* Versions 7.0.3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:* Versions 7.0.4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:* Versions 7.0.5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:* Versions 7.0.6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:* Versions 7.0.7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:* Versions 7.0.8 Vulnerable ·Apache
Remediation
- Fix · GHSA-vch7-92vf-jm44 org.apache.tomcat:tomcat (Maven) Fixed in 7.0.11 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 2 products
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
Timeline
- 2026-10-02 Threatist record created from CVE-2011-1419
- 2026-10-03 Alias added: GHSA-vch7-92vf-jm44
References
Other 13
- http://tomcat.apache.org/security-7.html
- 71027
- [announce] 20110302 [SECURITY] Tomcat 7 ignores @ServletSecurity annotations
- [users] 20110302 Re: @DenyAll does nothing
- [users] 20110302 Re: @DenyAll does nothing
- [users] 20110309 [SECURITY] Tomcat 7 ignores @ServletSecurity annotations
- https://github.com/apache/tomcat/commit/0ff4905158b77787a7f3aca55c9dec93456665dc
- https://github.com/apache/tomcat/commit/3e5b0455483eed55752047073e92403bfca8d3ec
- https://github.com/apache/tomcat
- https://web.archive.org/web/20110307182442/http://markmail.org/message/yzmyn44f5aetmm2r
- https://web.archive.org/web/20110323002552/http://markmail.org/message/lzx5273wsgl5pob6
- https://web.archive.org/web/20170202135440/http://www.securityfocus.com/bid/46685
- http://mail-archives.apache.org/mod_mbox/www-announce/201103.mbox/%[email protected]%3E
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2011-1419 · CVE Program
- CVE-2011-1419 · NVD
- FIRST EPSS
- GHSA-vch7-92vf-jm44 · GitHub Advisory Database · CC BY 4.0
- CVE-2011-1419 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences