Published: 31/08/2011 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 up to and including 7.0.20, 6.0.0 up to and including 6.0.33, 5.5.0 up to and including 5.5.33, and possibly other versions allow remote malicious users to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache tomcat 7.0.12
apache tomcat 7.0.20
apache tomcat 7.0.8
apache tomcat 7.0.1
apache tomcat 7.0.2
apache tomcat 7.0.5
apache tomcat 7.0.0
apache tomcat 7.0.6
apache tomcat 7.0.14
apache tomcat 7.0.11
apache tomcat 7.0.7
apache tomcat 7.0.13
apache tomcat 7.0.19
apache tomcat 7.0.16
apache tomcat 7.0.10
apache tomcat 7.0.17
apache tomcat 7.0.9
apache tomcat 7.0.4
apache tomcat 7.0.3
apache tomcat 6.0.33
apache tomcat 6.0.6
apache tomcat 6.0.11
apache tomcat 6.0.7
apache tomcat 6.0.4
apache tomcat 6.0.15
apache tomcat 6.0.20
apache tomcat 6.0.10
apache tomcat 6.0.31
apache tomcat 6.0.29
apache tomcat 6.0.3
apache tomcat 6.0.9
apache tomcat 6.0.24
apache tomcat 6.0.17
apache tomcat 6.0
apache tomcat 6.0.32
apache tomcat 6.0.28
apache tomcat 6.0.0
apache tomcat 6.0.14
apache tomcat 6.0.1
apache tomcat 6.0.12
apache tomcat 6.0.18
apache tomcat 6.0.5
apache tomcat 6.0.30
apache tomcat 6.0.2
apache tomcat 6.0.13
apache tomcat 6.0.26
apache tomcat 6.0.19
apache tomcat 6.0.27
apache tomcat 6.0.16
apache tomcat 6.0.8
apache tomcat 5.5.27
apache tomcat 5.5.18
apache tomcat 5.5.12
apache tomcat 5.5.14
apache tomcat 5.5.10
apache tomcat 5.5.4
apache tomcat 5.5.7
apache tomcat 5.5.1
apache tomcat 5.5.11
apache tomcat 5.5.28
apache tomcat 5.5.6
apache tomcat 5.5.26
apache tomcat 5.5.20
apache tomcat 5.5.15
apache tomcat 5.5.5
apache tomcat 5.5.30
apache tomcat 5.5.21
apache tomcat 5.5.22
apache tomcat 5.5.3
apache tomcat 5.5.32
apache tomcat 5.5.31
apache tomcat 5.5.9
apache tomcat 5.5.25
apache tomcat 5.5.33
apache tomcat 5.5.2
apache tomcat 5.5.0
apache tomcat 5.5.13
apache tomcat 5.5.24
apache tomcat 5.5.8
apache tomcat 5.5.16
apache tomcat 5.5.17
apache tomcat 5.5.29
apache tomcat 5.5.19
apache tomcat 5.5.23

Tomcat could be made to crash or expose sensitive information over the network ...

Synopsis Moderate: tomcat6 security and bug fix update Type/Severity Security Advisory: Moderate Topic Updated tomcat6 packages that fix several security issues and one bug arenow available for Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update as having moderatesecurity imp ...

Synopsis Moderate: tomcat5 security and bug fix update Type/Severity Security Advisory: Moderate Topic Updated tomcat5 packages that fix multiple security issues and two bugs arenow available for JBoss Enterprise Web Server 102 for Red HatEnterprise Linux 5 and 6The Red Hat Security Response Team has rat ...

Synopsis Moderate: tomcat6 security and bug fix update Type/Severity Security Advisory: Moderate Topic Updated tomcat6 packages that fix multiple security issues and three bugsare now available for JBoss Enterprise Web Server 102 for Red HatEnterprise Linux 5 and 6The Red Hat Security Response Team has r ...

Certain AJP protocol connector implementations in Apache Tomcat 700 through 7020, 600 through 6033, 550 through 5533, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request The HTTP Digest Ac ...

CWE-264 http://www.securityfocus.com/bid/49353 https://issues.apache.org/bugzilla/show_bug.cgi?id=51698 http://secunia.com/advisories/45748 http://www.securitytracker.com/id?1025993 http://securityreason.com/securityalert/8362 http://www.mandriva.com/security/advisories?name=MDVSA-2011:156 http://www.debian.org/security/2012/dsa-2401 http://secunia.com/advisories/49094 http://marc.info/?l=bugtraq&m=132215163318824&w=2 http://marc.info/?l=bugtraq&m=136485229118404&w=2 http://marc.info/?l=bugtraq&m=139344343412337&w=2 http://secunia.com/advisories/57126 http://marc.info/?l=bugtraq&m=133469267822771&w=2 https://exchange.xforce.ibmcloud.com/vulnerabilities/69472 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19465 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14933 http://secunia.com/advisories/48308 http://www.securityfocus.com/archive/1/519466/100/0/threaded https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E https://usn.ubuntu.com/1252-1/https://nvd.nist.gov

CVE-2011-3190

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect