Home > Vulnerability Database > CVE-2011-3190

Mend.io Vulnerability Database

CVE-2011-3190

Good to know:

Date: August 31, 2011

Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.

Language: Java

Severity Score

7.3

Related Resources (35)

Url: http://secunia.com/advisories/49094

Url: https://web.archive.org/web/20130121232525/http://www.securityfocus.com/archive/1/519466/100/0/threaded

Url: https://nvd.nist.gov/vuln/detail/CVE-2011-3190

Url: http://www.debian.org/security/2012/dsa-2401

Url: http://marc.info/?l=bugtraq&m=139344343412337&w=2

Url: https://github.com/apache/tomcat

Url: https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E

Url: http://marc.info/?l=bugtraq&m=133469267822771&w=2

Url: https://github.com/apache/tomcat55/commit/be3eb28f82250a5c81a1c42216570ebf892aefac

Url: https://access.redhat.com/security/cve/CVE-2011-3190

Url: http://www.mandriva.com/security/advisories?name=MDVSA-2011:156

Url: http://www.securityfocus.com/bid/49353

Url: http://secunia.com/advisories/45748

Url: https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E

Url: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14933

Url: https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E

Url: http://secunia.com/advisories/57126

Url: https://github.com/apache/tomcat/commit/a2538ce78f83b7376c48d12d8247600079d789b1

Url: https://web.archive.org/web/20130314002148/http://www.securityfocus.com/bid/49353

Url: https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E

Url: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19465

Url: https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E

Url: http://marc.info/?l=bugtraq&m=132215163318824&w=2

Url: http://marc.info/?l=bugtraq&m=136485229118404&w=2

Url: http://www.securityfocus.com/archive/1/519466/100/0/threaded

Url: http://secunia.com/advisories/48308

Url: https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E

Url: https://issues.apache.org/bugzilla/show_bug.cgi?id=51698

Url: https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E

Url: http://www.securitytracker.com/id?1025993

Url: http://securityreason.com/securityalert/8362

Url: https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E

Url: https://web.archive.org/web/20131214094052/http://www.securitytracker.com/id?1025993

Url: https://exchange.xforce.ibmcloud.com/vulnerabilities/69472

Url: https://www.mend.io/vulnerability-database/CVE-2011-3190

Severity Score

7.3

Weakness Type (CWE)

Authentication Issues

CWE-287

Permissions, Privileges, and Access Control

CWE-264

CVSS v3.1

Base Score:	7.3
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	LOW

CVSS v2

Base Score:	7.5
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2011-3190

Good to know:

Date: August 31, 2011

Language: Java

Severity Score

Related Resources (35)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?