CVE-2012-4431

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

• apache tomcat 6.0 • apache tomcat 6.0.0 • apache tomcat 6.0.1 • apache tomcat 6.0.2 • apache tomcat 6.0.3 • apache tomcat 6.0.4 • apache tomcat 6.0.5 • apache tomcat 6.0.6 • apache tomcat 6.0.7 • apache tomcat 6.0.8 • apache tomcat 6.0.9 • apache tomcat 6.0.10 • apache tomcat 6.0.11 • apache tomcat 6.0.12 • apache tomcat 6.0.13 • apache tomcat 6.0.14 • apache tomcat 6.0.15 • apache tomcat 6.0.16 • apache tomcat 6.0.17 • apache tomcat 6.0.18 • apache tomcat 6.0.19 • apache tomcat 6.0.20 • apache tomcat 6.0.24 • apache tomcat 6.0.26 • apache tomcat 6.0.27 • apache tomcat 6.0.28 • apache tomcat 6.0.29 • apache tomcat 6.0.30 • apache tomcat 6.0.31 • apache tomcat 6.0.32 • apache tomcat 6.0.33 • apache tomcat 6.0.35 • apache tomcat 7.0.0 • apache tomcat 7.0.1 • apache tomcat 7.0.2 • apache tomcat 7.0.3 • apache tomcat 7.0.4 • apache tomcat 7.0.5 • apache tomcat 7.0.6 • apache tomcat 7.0.7 • apache tomcat 7.0.8 • apache tomcat 7.0.9 • apache tomcat 7.0.10 • apache tomcat 7.0.11 • apache tomcat 7.0.12 • apache tomcat 7.0.13 • apache tomcat 7.0.14 • apache tomcat 7.0.15 • apache tomcat 7.0.16 • apache tomcat 7.0.17 • apache tomcat 7.0.18 • apache tomcat 7.0.19 • apache tomcat 7.0.20 • apache tomcat 7.0.21 • apache tomcat 7.0.22 • apache tomcat 7.0.23 • apache tomcat 7.0.25 • apache tomcat 7.0.28 • apache tomcat 7.0.30