CVE-2013-2067
⚪ Do wiadomości
Błąd w FormAuthenticator w Apache Tomcat umożliwia atak sesji przez wstrzyknięcie żądania.
CVSS
6.8
EPSS
7.1%
Exploit
none
Vendor
apache
Opis źródłowy (NVD)
java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a session fixation attack.
brak
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 6.8 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 7.1% |
| Opublikowano (NVD) | 2013-06-01 14:21:05 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-09 20:17:06 UTC |
Referencje
- http://archives.neohapsis.com/archives/bugtraq/2013-05/0041.html ([email protected])
- http://rhn.redhat.com/errata/RHSA-2013-0833.html ([email protected])
- http://rhn.redhat.com/errata/RHSA-2013-0834.html ([email protected])
- http://rhn.redhat.com/errata/RHSA-2013-0839.html ([email protected])
- http://rhn.redhat.com/errata/RHSA-2013-0964.html ([email protected])
- http://rhn.redhat.com/errata/RHSA-2013-1437.html ([email protected])
- http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/java/org/apache/catalina/authenticator/FormAuthenticator.java?r1=1417891&r2=1417890&pathrev=1417891 ([email protected]) [Patch]
- http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/authenticator/FormAuthenticator.java?r1=1408044&r2=1408043&pathrev=1408044 ([email protected]) [Patch]
- http://svn.apache.org/viewvc?view=revision&revision=1408044 ([email protected]) [Patch]
- http://svn.apache.org/viewvc?view=revision&revision=1417891 ([email protected]) [Patch]
- http://tomcat.apache.org/security-6.html ([email protected]) [Vendor Advisory]
- http://tomcat.apache.org/security-7.html ([email protected]) [Vendor Advisory]
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html ([email protected])
- http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html ([email protected])
- http://www.securityfocus.com/bid/59799 ([email protected])
- http://www.securityfocus.com/bid/64758 ([email protected])
- http://www.ubuntu.com/usn/USN-1841-1 ([email protected])
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E ([email protected])
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E ([email protected])
- https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E ([email protected])
- https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E ([email protected])
- https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E ([email protected])
- https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E ([email protected])