Moderate severityNVD Advisory· Published Mar 14, 2011· Updated Jun 16, 2026
CVE-2011-1419
CVE-2011-1419
Description
Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.tomcat:tomcatMaven | >= 7.0, < 7.0.11 | 7.0.11 |
Affected products
13cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*+ 11 more
- cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
21- svn.apache.org/viewvcnvdPatchWEB
- secunia.com/advisories/43684nvdVendor Advisory
- www.vupen.com/english/advisories/2011/0563nvdVendor Advisory
- github.com/advisories/GHSA-vch7-92vf-jm44ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2011-1419ghsaADVISORY
- mail-archives.apache.org/mod_mbox/www-announce/201103.mbox/%3C4D6E74FF.7050106@apache.org%3EghsaWEB
- marc.infonvdWEB
- tomcat.apache.org/security-7.htmlnvdWEB
- exchange.xforce.ibmcloud.com/vulnerabilities/65971nvdWEB
- exchange.xforce.ibmcloud.com/vulnerabilities/66154nvdWEB
- github.com/apache/tomcat/commit/0ff4905158b77787a7f3aca55c9dec93456665dcghsaWEB
- github.com/apache/tomcat/commit/3e5b0455483eed55752047073e92403bfca8d3ecghsaWEB
- web.archive.org/web/20110307182442/http://markmail.org/message/yzmyn44f5aetmm2rghsaWEB
- web.archive.org/web/20110323002552/http://markmail.org/message/lzx5273wsgl5pob6ghsaWEB
- web.archive.org/web/20170202135440/http://www.securityfocus.com/bid/46685ghsaWEB
- mail-archives.apache.org/mod_mbox/www-announce/201103.mbox/%3C4D6E74FF.7050106%40apache.org%3Envd
- markmail.org/message/lzx5273wsgl5pob6nvd
- markmail.org/message/yzmyn44f5aetmm2rnvd
- securityreason.com/securityalert/8131nvd
- www.osvdb.org/71027nvd
- www.securityfocus.com/bid/46685nvd
News mentions
0No linked articles in our index yet.