PT-2013-6012 · Apache · Apache Tomcat

CVE-2013-6357 · Publicado 2013-11-13 · Atualizado 2024-08-06

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 5.5.25 and earlier

Description A cross-site request forgery (CSRF) issue in the Manager application allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a "/manager/html/undeploy?path=" URI. The vendor disputes the significance of this report, stating that such attacks require a reckless system administrator.

Recommendations For Apache Tomcat versions 5.5.25 and earlier, consider disabling the Manager application until a patch is available to prevent exploitation of the CSRF vulnerability. Restrict access to the "/manager/html/undeploy" endpoint to minimize the risk of exploitation. Avoid using the path variable in the affected API endpoint until the issue is resolved.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2013-6357

Produtos afetados

Apache Tomcat

Referências · 5

• 🔥 http://webapp-security.com/wp-content/uploads/2013/11/Apache-Tomcat-5.5.25-CSRF-Vulnerabilities.txt · Exploit
• 🔥 https://exploit-db.com/exploits/29435 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-6357 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6357 · Nota
• https://t.me/cvenotify/89489 · Publicação no Telegram