CVE-2011-3190
Apache Tomcat Allows Remote Attackers to Spoof AJP Requests
EPSS 15.2%
Description
Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.
How to fix CVE-2011-3190
To remediate CVE-2011-3190, upgrade the affected package to a fixed version below.
- Maven/org.apache.tomcat:tomcat—upgrade to 7.0.21 or later
Is CVE-2011-3190 being exploited?
Moderate — EPSS is 15.2%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (1)
- >= 7.0.0, < 7.0.21