CVE-2011-1088: Apache Tomcat

Medium severity, CVSS 5.8. EPSS: 6.5% chance of exploitation in the next 30 days.

Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.

Affected products

• Apache Tomcat: version 7.0.0 only; version 7.0.1 only; version 7.0.2 only; version 7.0.3 only; version 7.0.4 only; version 7.0.5 only; …

Published 2011-03-14. Last modified 2026-06-16.