GitHub Advisoryadvisory · Maven

GHSA-jrcp-c39h-r29x Improper Neutralization of Input During Web Page Generation in Apache Tomcat

HIGH Published 2022-05-14 Modified 2024-02-22 Official page ↗
Aliases
CVE-2015-5346
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2022-07-06

Affected packages

• Maven org.apache.tomcat:tomcat: >= 9.0.0.M1, < 9.0.0.M2 → fixed in 9.0.0.M2 • Maven org.apache.tomcat:tomcat: >= 8.0.0.RC1, < 8.0.31 → fixed in 8.0.31 • Maven org.apache.tomcat:tomcat: >= 7.0.0, < 7.0.66 → fixed in 7.0.66

Description

Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.

Related

Alias · CVE (1)

  • CVE-2015-5346 Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References