GitHub Advisoryadvisory · Maven

GHSA-9xcj-c8cr-8c3c In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attack

HIGH Published 2019-12-26 Modified 2022-10-07 Official page ↗
Aliases
CVE-2019-17563
Ecosystem
Maven
Packages
org.apache.tomcat.embed:tomcat-embed-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-384
Reviewed
2019-12-26

Affected packages

• Maven org.apache.tomcat.embed:tomcat-embed-core: < 7.0.99 → fixed in 7.0.99 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 8.0.0, < 8.5.50 → fixed in 8.5.50 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 9.0.0, < 9.0.30 → fixed in 9.0.30

Description

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.

Related

Alias · CVE (1)

  • CVE-2019-17563 When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where… vulnerability

Weakness · CWE (1)

  • CWE-384 Session Fixation weakness

References