PT-2019-5228 · Apache+5 · Apache Tomcat+5
Lukas Braune
·
Publicado
2019-12-06
·
Atualizado
2024-06-15
·
CVE-2019-17563
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Apache Tomcat versions 9.0.0.M1 through 9.0.29
Apache Tomcat versions 8.5.0 through 8.5.49
Apache Tomcat versions 7.0.0 through 7.0.98
Description
The issue is related to a session fixation attack when using FORM authentication. An attacker could potentially exploit this to gain unauthorized access to confidential data, cause a denial of service, and impact data integrity. The window for exploitation is considered narrow, but the issue is treated as a security concern.
Recommendations
For Apache Tomcat versions 9.0.0.M1 through 9.0.29, update to a version outside of this range to mitigate the risk.
For Apache Tomcat versions 8.5.0 through 8.5.49, update to a version outside of this range to mitigate the risk.
For Apache Tomcat versions 7.0.0 through 7.0.98, update to a version outside of this range to mitigate the risk.
As a temporary workaround, consider restricting access to FORM authentication until a patch is available.
Exploit
Correção
Session Fixation
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Apache Tomcat
Centos
Red Hat
Suse
Ubuntu