Lucene search

K
githubGitHub Advisory DatabaseGHSA-MG4V-RF8P-GHQQ
HistoryMay 14, 2022 - 2:56 a.m.

Apache Tomcat allows remote attackers to bypass intended access restrictions

2022-05-1402:56:11
GitHub Advisory Database
github.com
10
apache tomcat
bypass access restrictions
http requests
web application

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

AI Score

6.8

Confidence

Low

EPSS

0.002

Percentile

57.1%

Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.

Affected configurations

Vulners
Node
org.apache.tomcattomcatRange7.0.07.0.10
VendorProductVersionCPE
org.apache.tomcattomcat*cpe:2.3:a:org.apache.tomcat:tomcat:*:*:*:*:*:*:*:*

References

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

AI Score

6.8

Confidence

Low

EPSS

0.002

Percentile

57.1%