GitHub Advisoryadvisory · Maven

GHSA-76vr-72mv-mf3q Cross-Site Request Forgery in Apache Tomcat

MEDIUM Published 2022-05-17 Modified 2022-07-13 Official page ↗
Aliases
CVE-2012-4431
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
Moderate
Weaknesses
CWE-352
Reviewed
2022-07-13

Affected packages

• Maven org.apache.tomcat:tomcat: >= 6.0.0, < 6.0.36 → fixed in 6.0.36 • Maven org.apache.tomcat:tomcat: >= 7.0.0, < 7.0.32 → fixed in 7.0.32

Description

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

Related

Alias · CVE (1)

  • CVE-2012-4431 org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References