CVE-2019-17563
High
Description
When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Apache Tomcat
PublishedDec 23, 2019
First seenDec 23, 2019
How to fix
Update
- org.apache.tomcat.embed:tomcat-embed-core7.0.99, 8.5.50, 9.0.30 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache tomcat | 7.0.0 ≤ v ≤ 7.0.98, 8.5.0 ≤ v ≤ 8.5.49, 9.0.0 ≤ v ≤ 9.0.29 | — |
| debian debian_linux | 8.0, 9.0, 10.0 | — |
| opensuse leap | 15.1 | — |
| canonical ubuntu_linux | 16.04 | — |
| oracle agile_engineering_data_management | 6.2.1.0 | — |
| oracle hyperion_infrastructure_technology | 11.1.2.4 | — |
| oracle instantis_enterprisetrack | 17.1 ≤ v ≤ 17.3 | — |
| oracle micros_relate_crm_software | 11.4 | — |
| oracle mysql_enterprise_monitor | v ≤ 4.0.11.5331, 8.0.0 ≤ v ≤ 8.0.18.1217 | — |
| oracle retail_order_broker | 15.0 | — |
| oracle transportation_management | 6.3.7 | — |
| org.apache.tomcat.embed:tomcat-embed-coreMaven | v < 7.0.99, 8.0.0 ≤ v < 8.5.50, 9.0.0 ≤ v < 9.0.30 | 7.0.99, 8.5.50, 9.0.30 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.