CVE-2011-2481

Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.

• http://marc.info/?l=bugtraq&m=139344343412337&w=2
• http://secunia.com/advisories/57126
• http://securitytracker.com/id?1025924
• http://svn.apache.org/viewvc?view=revision&revision=1137753Patch
• http://svn.apache.org/viewvc?view=revision&revision=1138788Patch
• http://tomcat.apache.org/security-7.htmlPatch, Vendor Advisory
• http://www.securityfocus.com/bid/49147
• https://issues.apache.org/bugzilla/show_bug.cgi?id=51395Exploit
• http://marc.info/?l=bugtraq&m=139344343412337&w=2
• http://secunia.com/advisories/57126
• http://securitytracker.com/id?1025924
• http://svn.apache.org/viewvc?view=revision&revision=1137753Patch
• http://svn.apache.org/viewvc?view=revision&revision=1138788Patch
• http://tomcat.apache.org/security-7.htmlPatch, Vendor Advisory
• http://www.securityfocus.com/bid/49147
• https://issues.apache.org/bugzilla/show_bug.cgi?id=51395Exploit

Published

Aug 15, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-2475Format string vulnerability in ECTrace.dll in the iMailGatew…
• CVE-2011-2476Cross-site scripting (XSS) vulnerability in Coppermine Photo…
• CVE-2011-2477Multiple cross-site scripting (XSS) vulnerabilities in confi…
• CVE-2011-2478Google SketchUp before 8 does not properly handle edge geome…
• CVE-2011-2479The Linux kernel before 2.6.39 does not properly create tran…5.5
• CVE-2011-2480Information Disclosure vulnerability in the 802.11 stack, as…7.5
• CVE-2011-2482A certain Red Hat patch to the sctp_sock_migrate function in…7.5
• CVE-2011-2483crypt_blowfish before 1.1, as used in PHP before 5.3.7 on ce…
• CVE-2011-2484The add_del_listener function in kernel/taskstats.c in the L…
• CVE-2011-2485The gdk_pixbuf__gif_image_load function in gdk-pixbuf/io-gif…
• CVE-2011-2486nspluginwrapper before 1.4.4 does not properly provide acces…
• CVE-2011-2487The implementations of PKCS#1 v1.5 key transport mechanism f…5.9