CVE-2011-3190
apache tomcat: no CVSS score yet. EPSS 15% chance of exploitation in the next 30 days. Fixed in org.apache.tomcat:tomcat 5.5.34, 6.0.34, 7.0.21.
Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.
- EPSS
- 15% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-11-01)
- CWE
- CWE-264
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:tomcat
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-c38m-v4m2-524v | Maven | org.apache.tomcat:tomcat | >=7.0.0 <7.0.21 | 7.0.21 |
| GHSA-c38m-v4m2-524v | Maven | org.apache.tomcat:tomcat | >=6.0.0 <6.0.34 | 6.0.34 |
| GHSA-c38m-v4m2-524v | Maven | org.apache.tomcat:tomcat | >=5.0.0 <5.5.34 | 5.5.34 |