When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade tomcat-javadocUpgrade tomcat-el-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-servlet-3.1-apiUpgrade tomcat-libUpgrade tomcat-el-3.0-apiUpgrade tomcat-docs-webappUpgrade tomcat-jsvcUpgrade tomcat-webappsUpgrade tomcat-servlet-4.0-apiUpgrade tomcat | May 17, 2023 | Dec 23, 2019 |
| Amazon_linux | — | Upgrade tomcat8 | Jan 17, 2020 | Dec 23, 2019 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.5.50Upgrade Apache Tomcat to 9.0.30Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 7.0.99 | Dec 23, 2019 | Dec 23, 2019 |
| Centos_linux | — | Upgrade tomcat-libUpgrade tomcat-el-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-javadocUpgrade tomcat-webappsUpgrade tomcat-jsvcUpgrade tomcat-jsp-2.2-apiUpgrade tomcatUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-docs-webapp | Oct 1, 2020 | Dec 23, 2019 |
| Debian | — | Upgrade tomcat9 | Dec 30, 2019 | Dec 23, 2019 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jan 23, 2020 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | Mar 20, 2020 | Dec 23, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade tomcat-admin-webappsUpgrade tomcatUpgrade tomcat-el-2.2-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-servlet-3.0-api | Jun 17, 2020 | Dec 23, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade tomcat-el-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-jsp-2.2-api | Apr 16, 2020 | Dec 23, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tomcat-jsp-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat | Feb 24, 2020 | Dec 23, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-el-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcatUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-libUpgrade tomcat-servlet-4.0-api | Feb 26, 2020 | Dec 23, 2019 |
| Oracle Missing Cpu Apr 2020 | — | Apply the April 2020 Critical Patch Update (CPU) for Oracle Database | Apr 16, 2020 | Dec 23, 2019 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8 to version 8.5.50-11.4.18.0.1.2.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.50-11.4.18.0.1.2.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.50-11.4.18.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Dec 23, 2019 |
| Oracle_linux | — | Upgrade tomcat-jsvcUpgrade tomcat-libUpgrade tomcat-el-2.2-apiUpgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-javadocUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-admin-webapps | Oct 7, 2020 | Dec 18, 2019 |
| Redhat_linux | — | Upgrade tomcatUpgrade tomcat-jsvcUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-docs-webappUpgrade tomcat-javadocNo solution existsUpgrade tomcat-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-libUpgrade tomcat-admin-webapps | Oct 1, 2020 | Dec 23, 2019 |
| Suse | — | Upgrade tomcat-libUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-embedUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-el-3_0-apiUpgrade tomcat-webappsUpgrade tomcat-jsvcUpgrade tomcat-javadocUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-docs-webappUpgrade tomcat-admin-webappsUpgrade tomcat | Jan 15, 2020 | Dec 23, 2019 |
| Ubuntu | — | Upgrade libtomcat8-javaUpgrade tomcat8 | Jan 28, 2020 | Dec 23, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 23, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub