{"id":"CVE-2011-1582","aliases":["EUVD-2022-2261","GHSA-3xpj-jgv5-q4vv"],"status":"published","title":"Access restriction bypass in Apache Tomcat","description":"Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.06016,"percentile":0.93388,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2011-05-20T22:00:00Z","modified":"2026-06-16T23:29:40Z","fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","fixed_in":["7.0.14"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.12"},{"fixed":"7.0.14"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.12"},{"fixed":"7.0.14"}]}]}],"products":[{"vendor":"apache","product":"tomcat"}],"references":[{"url":"http://securityreason.com/securityalert/8256","tags":["third-party-advisory","x_refsource_SREASON","x_transferred","web"]},{"url":"http://www.securityfocus.com/archive/1/518032/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://mail-archives.apache.org/mod_mbox/www-announce/201105.mbox/%3C4DD26E30.2060103%40apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2011/1255","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Vendor Advisory"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1100832","tags":["x_refsource_CONFIRM","x_transferred","Patch","web"]},{"url":"http://www.securityfocus.com/bid/47886","tags":["vdb-entry","x_refsource_BID","x_transferred","Patch"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/67515","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.14_%28released_12_May_2011%29","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-1582","tags":["advisory"]},{"url":"http://mail-archives.apache.org/mod_mbox/www-announce/201105.mbox/%3C4DD26E30.2060103@apache.org%3E","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/299b26af66793438c323ea6b18462fa44683080f","tags":["web"]},{"url":"https://web.archive.org/web/20111110135226/http://www.securityfocus.com/archive/1/518032/100/0/threaded","tags":["web"]},{"url":"https://web.archive.org/web/20170202135510/http://www.securityfocus.com/bid/47886","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3xpj-jgv5-q4vv"},{"url":"https://github.com/apache/tomcat","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2011-1582","description":"Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.","status":"published","published":"2011-05-20T22:00:00Z","modified":"2024-08-06T22:28:41.822Z","updated_at":"2026-11-02T14:35:38.321377Z"}],"euvd":[{"id":"EUVD-2022-2261","description":"Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.","status":"published","published":"2011-05-20T22:00:00Z","modified":"2024-08-06T22:28:41Z","updated_at":"2026-11-03T01:55:56.243798Z"}],"ghsa":[{"id":"GHSA-3xpj-jgv5-q4vv","title":"Access restriction bypass in Apache Tomcat","description":"Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.","status":"published","published":"2022-05-14T02:55:47Z","modified":"2024-02-21T21:26:09Z","updated_at":"2026-11-02T14:37:38.20753Z"}],"nvd":[{"id":"CVE-2011-1582","description":"Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.","status":"published","published":"2011-05-20T22:55:03.75Z","modified":"2026-06-16T23:29:40.563Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:08.47516Z"}],"osv":[{"id":"GHSA-3xpj-jgv5-q4vv","title":"Access restriction bypass in Apache Tomcat","description":"Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.","status":"published","published":"2022-05-14T02:55:47Z","modified":"2024-02-21T21:26:08Z","updated_at":"2026-11-02T15:46:36.092962Z"}]}}