CVE-2011-2481: Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml,…

Unscored severity · published Aug 15, 2011

CVE-2011-2481

Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml,…

–

CVSS

0.8%

EPSS

On KEV

Description

Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.

Exploitation

Is it being used?

Exploit prediction (EPSS)0.8% · higher than 58% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Tomcat · Apache

7.0.0; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +10 more · source: NVD

Affected product

Tomcat