vulnerability
Huawei EulerOS: CVE-2019-17563: tomcat security update
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:N/AC:H/Au:N/C:P/I:P/A:P) | Dec 23, 2019 | Feb 24, 2020 | Apr 1, 2026 |
Severity
5
CVSS
(AV:N/AC:H/Au:N/C:P/I:P/A:P)
Published
Dec 23, 2019
Added
Feb 24, 2020
Modified
Apr 1, 2026
Description
When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.
Solutions
huawei-euleros-2_0_sp5-upgrade-tomcathuawei-euleros-2_0_sp5-upgrade-tomcat-admin-webappshuawei-euleros-2_0_sp5-upgrade-tomcat-el-2.2-apihuawei-euleros-2_0_sp5-upgrade-tomcat-jsp-2.2-apihuawei-euleros-2_0_sp5-upgrade-tomcat-libhuawei-euleros-2_0_sp5-upgrade-tomcat-servlet-3.0-apihuawei-euleros-2_0_sp5-upgrade-tomcat-webapps
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.