Apache Tomcat CVE-2011-2526 Input Validation Bypass Vulnerability

Description

Tomcat provides support for sendfile with the HTTP NIO and HTTP APR connectors. sendfile is used automatically for content served via the DefaultServlet and deployed web applications may use it directly via setting request attributes. These request attributes were not validated. When running under a security manager, this lack of validation allowed a malicious web application to do one or more of the following that would normally be prevented by a security manager:

Affected Applications

Apache Tomcat

CVE References

Other References