CVE-2011-2481
Apache Tomcat Allows Replacing of XML Parser
Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
Exploit likelihood
What each source reports
NVD Score used
Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
- Record
CVE-2011-2481- CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
- Record
CVE-2011-2481- Updated
- 2026-11-02
EUVDEUVD-2022-5123 No score
Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
- Record
EUVD-2022-5123- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r7c8-hghc-2mp8 No score
Apache Tomcat Allows Replacing of XML Parser
Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
- Record
GHSA-r7c8-hghc-2mp8- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-r7c8-hghc-2mp8 No score
Apache Tomcat Allows Replacing of XML Parser
Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
- Record
GHSA-r7c8-hghc-2mp8- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
7.0.0 up to 7.0.17 | 7.0.17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-2481 is a medium vulnerability (CVSS 4.6) in Apache Tomcat, published August 15, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.84%, the 58th percentile. Fixed in org.apache.tomcat:tomcat 7.0.17.
References
tomcat.apache.org/security-7.html
svn.apache.org/viewvc?view=revision&revision=1138788
securitytracker.com/id?1025924
issues.apache.org/bugzilla/show_bug.cgi?id=51395
secunia.com/advisories/57126
Show 8 moreShow less
securityfocus.com/bid/49147
marc.info?l=bugtraq&m=139344343412337&w=2
nvd.nist.gov/vuln/detail/CVE-2011-2481
web.archive.org/web/20111209022500/http://www.securityfocus.com/bid/49147
github.com/apache/tomcat/commit/279e4451cb996f810fbca2f78b6340412d9daa7b