Back
CVE-2011-2481
Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local…
Medium4.6EPSS 0.84%
- Published
- Updated
- Reserved
- Assigned by
- redhat
Description
Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 2.0 | Medium4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
- EPSS (exploitation in 30 days)
- 0.84% · top 42% of all CVEs (4 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.6.
Weakness
- n/a
Affected products
n/a
- affected n/a
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.apache.tomcat:tomcatGHSA-r7c8-hghc-2mp8 (opens in a new tab)
References (8)
- http://tomcat.apache.org/security-7.html (opens in a new tab)x_refsource_CONFIRMx_transferred
- http://svn.apache.org/viewvc?view=revision&revision=1138788 (opens in a new tab)x_refsource_CONFIRMx_transferred
- 1025924 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
- https://issues.apache.org/bugzilla/show_bug.cgi?id=51395 (opens in a new tab)x_refsource_CONFIRMx_transferred
- 57126 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- http://svn.apache.org/viewvc?view=revision&revision=1137753 (opens in a new tab)x_refsource_CONFIRMx_transferred
- 49147 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- HPSBST02955 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-r7c8-hghc-2mp8 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2011-2481)Record last updated .