CVE-2011-1419
Apache Tomcat does not follow ServletSecurity annotations
Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.
Exploit likelihood
What each source reports
NVD Score used
Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.
- Record
CVE-2011-1419- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.
- Record
CVE-2011-1419- Updated
- 2026-11-02
EUVDEUVD-2022-5341 No score
Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.
- Record
EUVD-2022-5341- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vch7-92vf-jm44 No score
Apache Tomcat does not follow ServletSecurity annotations
Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.
- Record
GHSA-vch7-92vf-jm44- Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-vch7-92vf-jm44 No score
Apache Tomcat does not follow ServletSecurity annotations
Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.
- Record
GHSA-vch7-92vf-jm44- Weakness
- CWE-284
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
7.0 up to 7.0.11 | 7.0.11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-1419 is a medium vulnerability (CVSS 5.8) in Apache Tomcat, published March 14, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.54%, the 93rd percentile. Fixed in org.apache.tomcat:tomcat 7.0.11.
References
exchange.xforce.ibmcloud.com/vulnerabilities/65971
secunia.com/advisories/43684
securityfocus.com/bid/46685
vupen.com/english/advisories/2011/0563
tomcat.apache.org/security-7.html
securityreason.com/securityalert/8131
Show 16 moreShow less
osvdb.org/71027
mail-archives.apache.org/mod_mbox/www-announce/201103.mbox/%3C4D6E74FF.7050106%40apache.org%3E
svn.apache.org/viewvc?view=revision&revision=1079752
markmail.org/message/lzx5273wsgl5pob6
marc.info?l=tomcat-user&m=129966773405409&w=2
nvd.nist.gov/vuln/detail/CVE-2011-1419
github.com/apache/tomcat/commit/0ff4905158b77787a7f3aca55c9dec93456665dc
web.archive.org/web/20110307182442/http://markmail.org/message/yzmyn44f5aetmm2r