CVE-2011-2526

medium Apache
CVSS v3 Base Score
4.4
AV:L/AC:M/Au:N/C:P/I:P/A:P
EPSS Score
0.1%
Exploitation probability in 30 days
Top 68% most likely to be exploited
Attack Characteristics
Attack Vector
Local
Attack Complexity
M
Confidentiality
P
Integrity
P
Availability
P
Published: July 14, 2011 (5418 days ago)
Last Modified: April 29, 2026
Vendor: Apache
Source: NVD

Description

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.

CWE

CWE-20

Affected Products

apache tomcat

References

🔗 marc.info 🔗 marc.info 🔗 marc.info 🔗 marc.info 🔗 osvdb.org