CVE-2011-1582
Access restriction bypass in Apache Tomcat
Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.
Exploit likelihood
What each source reports
NVD Score used
Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.
- Record
CVE-2011-1582- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.
- Record
CVE-2011-1582- Updated
- 2026-11-02
EUVDEUVD-2022-2261 No score
Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.
- Record
EUVD-2022-2261- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3xpj-jgv5-q4vv No score
Access restriction bypass in Apache Tomcat
Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.
- Record
GHSA-3xpj-jgv5-q4vv- Updated
- 2026-11-02
OSVGHSA-3xpj-jgv5-q4vv No score
Access restriction bypass in Apache Tomcat
Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.
- Record
GHSA-3xpj-jgv5-q4vv- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
7.0.12 up to 7.0.14 | 7.0.14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-1582 is a medium vulnerability (CVSS 4.3) in Apache Tomcat, published May 20, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.02%, the 93rd percentile. Fixed in org.apache.tomcat:tomcat 7.0.14.
References
securityreason.com/securityalert/8256
securityfocus.com/archive/1/518032/100/0/threaded
mail-archives.apache.org/mod_mbox/www-announce/201105.mbox/%3C4DD26E30.2060103%40apache.org%3E
vupen.com/english/advisories/2011/1255
svn.apache.org/viewvc?view=revision&revision=1100832
Show 9 moreShow less
exchange.xforce.ibmcloud.com/vulnerabilities/67515
tomcat.apache.org/security-7.html
nvd.nist.gov/vuln/detail/CVE-2011-1582
github.com/apache/tomcat/commit/299b26af66793438c323ea6b18462fa44683080f
web.archive.org/web/20111110135226/http://www.securityfocus.com/archive/1/518032/100/0/threaded