PT-2013-6012 · Apache · Apache Tomcat

Published 2013-11-13 · Updated 2024-08-06 · CVE-2013-6357

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 5.5.25 and earlier

Description A cross-site request forgery (CSRF) issue in the Manager application allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a "/manager/html/undeploy?path=" URI. The vendor disputes the significance of this report, stating that such attacks require a reckless system administrator.

Recommendations For Apache Tomcat versions 5.5.25 and earlier, consider disabling the Manager application until a patch is available to prevent exploitation of the CSRF vulnerability. Restrict access to the "/manager/html/undeploy" endpoint to minimize the risk of exploitation. Avoid using the path variable in the affected API endpoint until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2013-6357

Affected Products

Apache Tomcat

References · 5

• 🔥 http://webapp-security.com/wp-content/uploads/2013/11/Apache-Tomcat-5.5.25-CSRF-Vulnerabilities.txt · Exploit
• 🔥 https://exploit-db.com/exploits/29435 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-6357 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6357 · Note
• https://t.me/cvenotify/89489 · Telegram Post