NVD

Id
9300  
Name
CVE-2011-2526  
Description
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.  
Reject
 
CVSS Version
2  
CVSS Score
4.4  
Severity
Medium  
CVSS Base Score
4.4  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2011-07-14  
Modified Date
2016-08-22  
Seq
2011-2526  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
53240 9300 CVE-2011-2526 SSRT100627  View
53241 9300 CVE-2011-2526 SSRT100825  View
53242 9300 CVE-2011-2526 HPSBUX02860  View
53243 9300 CVE-2011-2526 HPSBST02955  View
53244 9300 CVE-2011-2526 oval:org.mitre.oval:def:14573  View
53245 9300 CVE-2011-2526 oval:org.mitre.oval:def:19514  View
53246 9300 CVE-2011-2526 RHSA-2012:0074  View
53247 9300 CVE-2011-2526 RHSA-2012:0075  View
53248 9300 CVE-2011-2526 RHSA-2012:0076  View
53249 9300 CVE-2011-2526 RHSA-2012:0077  View
53250 9300 CVE-2011-2526 RHSA-2012:0078  View
53251 9300 CVE-2011-2526 RHSA-2012:0325  View
53252 9300 CVE-2011-2526 http://svn.apache.org/viewvc?view=revision&revision=1145383  View
53253 9300 CVE-2011-2526 http://svn.apache.org/viewvc?view=revision&revision=1145571  View
53254 9300 CVE-2011-2526 http://svn.apache.org/viewvc?view=revision&revision=1145694  View
53255 9300 CVE-2011-2526 http://svn.apache.org/viewvc?view=revision&revision=1146005  View
53256 9300 CVE-2011-2526 http://tomcat.apache.org/security-5.html  View
53257 9300 CVE-2011-2526 http://tomcat.apache.org/security-6.html  View
53258 9300 CVE-2011-2526 http://tomcat.apache.org/security-7.html  View
53259 9300 CVE-2011-2526 DSA-2401  View
53260 9300 CVE-2011-2526 MDVSA-2011:156  View
53261 9300 CVE-2011-2526 20110713 [SECURITY] CVE-2011-2526 Apache Tomcat Information disclosure and availability vulnerabilities  View
53262 9300 CVE-2011-2526 48667  View
53263 9300 CVE-2011-2526 1025788  View
53264 9300 CVE-2011-2526 tomcat-sendfile-info-disclosure(68541)  View
53265 9300 CVE-2011-2526 https://bugzilla.redhat.com/show_bug.cgi?id=720948  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
31690 JVNDB-2011-001930 Apache Tomcat におけるアクセス制限を回避される脆弱性 Apache Tomcat は、HTTP APR または HTTP NIO コネクタに対して sendfile が有効である時、リクエスト属性の検証を行わないため、アクセス制限を回避される、またはサービス運用妨害 (無限ループまたは JVM クラッシュ) 状態となる脆弱性が存在します。 CVE-2011-2526 50433 CVE-2011-2526 9300 4.4 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-001930.html 2011-07-11 2015-03-05 View