CVE-2011-3190
Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.
- Affected products
- Apache Tomcat, Centos, Hp-Ux, Red Hat
- Apache Tomcat
- = 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.12, 7.0.13, 7.0.14, 7.0.16, 7.0.17, 7.0.19, 7.0.20
- Fix
- Available
- CVSS 2.0
- 7.5 HIGH
- EPSS
- 15.2% (96th percentile)
- Weakness
- CWE-264
- NVD status
- Modified
- Published
- 2011-08-31
CVE-2011-3190 at NVD
No indexed exploits for CVE-2011-3190 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2011-3190 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.