CVE-2011-4858 EXPLOIT
5.0
MEDIUM · CVSS 2.0 · EPSS 79.7% (pctl 100)
Patch early
A public exploit exists.
Description
Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Scoring
| CVSS | 5.0 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:P |
| EPSS | 79.71% — more likely to be exploited than 100% of all CVEs |
| Weakness | CWE-399 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2012-01-05 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| apache | tomcat |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | MyBulletinBoard (MyBB) 1.1.5 - 'CLIENT-IP' SQL Injection | 2006-07-15 |
References
- http://mail-archives.apache.org/mod_mbox/tomcat-announce/201112.mbox/%3c4EFB9800.5010106%40apache.org%3e
- http://marc.info/?l=bugtraq&m=132871655717248&w=2
- http://marc.info/?l=bugtraq&m=133294394108746&w=2
- http://marc.info/?l=bugtraq&m=136485229118404&w=2
- http://rhn.redhat.com/errata/RHSA-2012-0074.html
- http://rhn.redhat.com/errata/RHSA-2012-0075.html
- http://rhn.redhat.com/errata/RHSA-2012-0076.html
- http://rhn.redhat.com/errata/RHSA-2012-0077.html
- http://rhn.redhat.com/errata/RHSA-2012-0078.html
- http://rhn.redhat.com/errata/RHSA-2012-0089.html
- http://rhn.redhat.com/errata/RHSA-2012-0325.html
- http://rhn.redhat.com/errata/RHSA-2012-0406.html
- http://secunia.com/advisories/48549
- http://secunia.com/advisories/48790
- http://secunia.com/advisories/48791
- http://secunia.com/advisories/54971
- http://secunia.com/advisories/55115
- http://tomcat.apache.org/tomcat-7.0-doc/changelog.html
- http://www.debian.org/security/2012/dsa-2401
- http://www.kb.cert.org/vuls/id/903934
→ the Explorer · watch your stack · NVD