Yüksek CVSS 7.5

CVE-2019-17563: Tomcat: güvenlik açığı

Yayın: 23 Aralık 2019 20:15 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.

Özet bilgiler

Ürün: Apache Tomcat
CVSS v3.1: 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: %10,69 (yüzdelik 96)
CWE: CWE-384
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
apache-tomcat	7.0.0	7.0.98	—
apache-tomcat	8.5.0	8.5.49	—
apache-tomcat	9.0.0	9.0.29	—
debian-debian-linux	8.0	8.0	—
debian-debian-linux	9.0	9.0	—
debian-debian-linux	10.0	10.0	—
opensuse-leap	15.1	15.1	—
canonical-ubuntu-linux	16.04	16.04	—
oracle-agile-engineering-data-management	6.2.1.0	6.2.1.0	—
oracle-hyperion-infrastructure-technology	11.1.2.4	11.1.2.4	—
oracle-instantis-enterprisetrack	17.1	17.3	—
oracle-micros-relate-crm-software	11.4	11.4	—
oracle-mysql-enterprise-monitor	—	4.0.11.5331	—
oracle-mysql-enterprise-monitor	8.0.0	8.0.18.1217	—
oracle-retail-order-broker	15.0	15.0	—
oracle-transportation-management	6.3.7	6.3.7	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları