When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade tomcat-servlet-4.0-apiUpgrade tomcatUpgrade tomcat-jsvcUpgrade tomcat-el-3.0-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-javadocUpgrade tomcat-libUpgrade tomcat-servlet-3.1-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsp-2.3-api | May 17, 2023 | Dec 23, 2019 |
| Amazon_linux | — | Upgrade tomcat8 | Jan 17, 2020 | Dec 23, 2019 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.5.50Upgrade Apache Tomcat to 9.0.30Upgrade Apache Tomcat to 7.0.99Upgrade Apache Tomcat to the latest available version | Dec 23, 2019 | Dec 23, 2019 |
| Centos_linux | — | Upgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcatUpgrade tomcat-jsvcUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-javadocUpgrade tomcat-webappsUpgrade tomcat-docs-webapp | Oct 1, 2020 | Dec 23, 2019 |
| Debian | — | Upgrade tomcat9 | Dec 30, 2019 | Dec 23, 2019 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jan 23, 2020 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | Mar 20, 2020 | Dec 23, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade tomcat-el-2.2-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcatUpgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-servlet-3.0-api | Jun 17, 2020 | Dec 23, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade tomcat-admin-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-webappsUpgrade tomcatUpgrade tomcat-libUpgrade tomcat-jsp-2.2-api | Apr 16, 2020 | Dec 23, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-webapps | Feb 24, 2020 | Dec 23, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-libUpgrade tomcatUpgrade tomcat-el-3.0-apiUpgrade tomcat-admin-webapps | Feb 26, 2020 | Dec 23, 2019 |
| Oracle Missing Cpu Apr 2020 | — | Apply the April 2020 Critical Patch Update (CPU) for Oracle Database | Apr 16, 2020 | Dec 23, 2019 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8 to version 8.5.50-11.4.18.0.1.2.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.50-11.4.18.0.1.2.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.50-11.4.18.0.1.2.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3 | Jan 19, 2021 | Dec 23, 2019 |
| Oracle_linux | — | Upgrade tomcat-jsvcUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-javadocUpgrade tomcatUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-docs-webappUpgrade tomcat-webapps | Oct 7, 2020 | Dec 18, 2019 |
| Redhat_linux | — | Upgrade tomcat-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-libUpgrade tomcat-admin-webappsNo solution existsUpgrade tomcatUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-javadocUpgrade tomcat-jsvcUpgrade tomcat-el-2.2-apiUpgrade tomcat-docs-webapp | Oct 1, 2020 | Dec 23, 2019 |
| Suse | — | Upgrade tomcat-jsp-2_3-apiUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-libUpgrade tomcat-embedUpgrade tomcatUpgrade tomcat-jsvcUpgrade tomcat-el-3_0-apiUpgrade tomcat-docs-webappUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-javadocUpgrade tomcat-admin-webappsUpgrade tomcat-webapps | Jan 15, 2020 | Dec 23, 2019 |
| Ubuntu | — | Upgrade tomcat8Upgrade libtomcat8-java | Jan 28, 2020 | Dec 23, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 23, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub