PT-2012-5398 · Apache+2 · Apache Tomcat+2

Publicado

2012-10-19

·

Atualizado

2022-05-17

·

CVE-2012-4431

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 6.0.0 through 6.0.35 Apache Tomcat versions 7.0.0 through 7.0.31
Description The issue allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier. This occurs when a request is made to a protected resource without a session identifier present in the request.
Recommendations For Apache Tomcat versions 6.0.0 through 6.0.35, update to version 6.0.36 or later. For Apache Tomcat versions 7.0.0 through 7.0.31, update to version 7.0.32 or later.

Exploit

Correção

CSRF

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-264CWE-352

Identificadores relacionados

CVE-2012-4431
GHSA-76VR-72MV-MF3Q
HPSBUX02866
RHSA-2013:0266
RHSA-2013:0268
RHSA-2013:0647

Produtos afetados

Apache Tomcat
Hp-Ux
Suse