Skip to content

CVE-2015-5346 Improper Neutralization of Input During Web Page Generation in Apache Tomcat

HighCVSS 8.1 EPSS 10.6% Public exploit
Published
Updated
Exploit status
Public exploit available
Sign in for asset impact Search another CVE

Description

Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.

Affected products

ProductAffected versionsFixed in
org.apache.tomcat/tomcat(Maven) >= 9.0.0.M1, < 9.0.0.M2 9.0.0.M2
org.apache.tomcat/tomcat(Maven) = 9.0.0.M1 No fix listed
org.apache.tomcat/tomcat(Maven) >= 8.0.0.RC1, < 8.0.31 8.0.31
org.apache.tomcat/tomcat(Maven) = 8.0.1 No fix listed
org.apache.tomcat/tomcat(Maven) = 8.0.11 No fix listed
org.apache.tomcat/tomcat(Maven) = 8.0.12 No fix listed
org.apache.tomcat/tomcat(Maven) = 8.0.14 No fix listed
org.apache.tomcat/tomcat(Maven) = 8.0.15 No fix listed
org.apache.tomcat/tomcat(Maven) = 8.0.17 No fix listed
org.apache.tomcat/tomcat(Maven) = 8.0.18 No fix listed
org.apache.tomcat/tomcat(Maven) = 8.0.20 No fix listed
org.apache.tomcat/tomcat(Maven) = 8.0.21 No fix listed
org.apache.tomcat/tomcat(Maven) = 8.0.22 No fix listed
org.apache.tomcat/tomcat(Maven) = 8.0.23 No fix listed
org.apache.tomcat/tomcat(Maven) = 8.0.24 No fix listed
org.apache.tomcat/tomcat(Maven) = 8.0.26 No fix listed
org.apache.tomcat/tomcat(Maven) = 8.0.27 No fix listed
org.apache.tomcat/tomcat(Maven) = 8.0.28 No fix listed
org.apache.tomcat/tomcat(Maven) = 8.0.29 No fix listed
org.apache.tomcat/tomcat(Maven) = 8.0.3 No fix listed
org.apache.tomcat/tomcat(Maven) = 8.0.30 No fix listed
org.apache.tomcat/tomcat(Maven) = 8.0.5 No fix listed
org.apache.tomcat/tomcat(Maven) = 8.0.8 No fix listed
org.apache.tomcat/tomcat(Maven) = 8.0.9 No fix listed
org.apache.tomcat/tomcat(Maven) >= 7.0.0, < 7.0.66 7.0.66
Show 94 more
ProductAffected versionsFixed in
org.apache.tomcat/tomcat(Maven) = 7.0.35 No fix listed
org.apache.tomcat/tomcat(Maven) = 7.0.37 No fix listed
org.apache.tomcat/tomcat(Maven) = 7.0.39 No fix listed
org.apache.tomcat/tomcat(Maven) = 7.0.40 No fix listed
org.apache.tomcat/tomcat(Maven) = 7.0.41 No fix listed
org.apache.tomcat/tomcat(Maven) = 7.0.42 No fix listed
org.apache.tomcat/tomcat(Maven) = 7.0.47 No fix listed
org.apache.tomcat/tomcat(Maven) = 7.0.50 No fix listed
org.apache.tomcat/tomcat(Maven) = 7.0.52 No fix listed
org.apache.tomcat/tomcat(Maven) = 7.0.53 No fix listed
org.apache.tomcat/tomcat(Maven) = 7.0.54 No fix listed
org.apache.tomcat/tomcat(Maven) = 7.0.55 No fix listed
org.apache.tomcat/tomcat(Maven) = 7.0.56 No fix listed
org.apache.tomcat/tomcat(Maven) = 7.0.57 No fix listed
org.apache.tomcat/tomcat(Maven) = 7.0.59 No fix listed
org.apache.tomcat/tomcat(Maven) = 7.0.61 No fix listed
org.apache.tomcat/tomcat(Maven) = 7.0.62 No fix listed
org.apache.tomcat/tomcat(Maven) = 7.0.63 No fix listed
org.apache.tomcat/tomcat(Maven) = 7.0.64 No fix listed
org.apache.tomcat/tomcat(Maven) = 7.0.65 No fix listed
org.apache.tomcat/tomcat(Maven) >= 8.0.0.RC1, <= 8.0.30 No fix listed
org.apache.tomcat/tomcat(Maven) >= 7.0.0, <= 7.0.65 No fix listed
apache tomcat = 7.0.0-beta No fix listed
apache tomcat = 7.0.2-beta No fix listed
apache tomcat = 7.0.4-beta No fix listed
apache tomcat = 7.0.5-beta No fix listed
apache tomcat = 7.0.6 No fix listed
apache tomcat = 7.0.10 No fix listed
apache tomcat = 7.0.11 No fix listed
apache tomcat = 7.0.12 No fix listed
apache tomcat = 7.0.14 No fix listed
apache tomcat = 7.0.16 No fix listed
apache tomcat = 7.0.19 No fix listed
apache tomcat = 7.0.20 No fix listed
apache tomcat = 7.0.21 No fix listed
apache tomcat = 7.0.22 No fix listed
apache tomcat = 7.0.23 No fix listed
apache tomcat = 7.0.25 No fix listed
apache tomcat = 7.0.26 No fix listed
apache tomcat = 7.0.27 No fix listed
apache tomcat = 7.0.28 No fix listed
apache tomcat = 7.0.29 No fix listed
apache tomcat = 7.0.30 No fix listed
apache tomcat = 7.0.32 No fix listed
apache tomcat = 7.0.33 No fix listed
apache tomcat = 7.0.34 No fix listed
apache tomcat = 7.0.35 No fix listed
apache tomcat = 7.0.37 No fix listed
apache tomcat = 7.0.39 No fix listed
apache tomcat = 7.0.40 No fix listed
apache tomcat = 7.0.41 No fix listed
apache tomcat = 7.0.42 No fix listed
apache tomcat = 7.0.47 No fix listed
apache tomcat = 7.0.50 No fix listed
apache tomcat = 7.0.52 No fix listed
apache tomcat = 7.0.53 No fix listed
apache tomcat = 7.0.54 No fix listed
apache tomcat = 7.0.55 No fix listed
apache tomcat = 7.0.56 No fix listed
apache tomcat = 7.0.57 No fix listed
apache tomcat = 7.0.59 No fix listed
apache tomcat = 7.0.61 No fix listed
apache tomcat = 7.0.62 No fix listed
apache tomcat = 7.0.63 No fix listed
apache tomcat = 7.0.64 No fix listed
apache tomcat = 7.0.65 No fix listed
apache tomcat = 8.0.0-rc1 No fix listed
apache tomcat = 8.0.0-rc10 No fix listed
apache tomcat = 8.0.0-rc3 No fix listed
apache tomcat = 8.0.0-rc5 No fix listed
apache tomcat = 8.0.1 No fix listed
apache tomcat = 8.0.3 No fix listed
apache tomcat = 8.0.11 No fix listed
apache tomcat = 8.0.12 No fix listed
apache tomcat = 8.0.14 No fix listed
apache tomcat = 8.0.15 No fix listed
apache tomcat = 8.0.17 No fix listed
apache tomcat = 8.0.18 No fix listed
apache tomcat = 8.0.20 No fix listed
apache tomcat = 8.0.21 No fix listed
apache tomcat = 8.0.22 No fix listed
apache tomcat = 8.0.23 No fix listed
apache tomcat = 8.0.24 No fix listed
apache tomcat = 8.0.26 No fix listed
apache tomcat = 8.0.27 No fix listed
apache tomcat = 8.0.28 No fix listed
apache tomcat = 8.0.29 No fix listed
apache tomcat = 9.0.0-milestone1 No fix listed
Canonical Ubuntu Linux = 12.04 No fix listed
Canonical Ubuntu Linux = 14.04 No fix listed
Canonical Ubuntu Linux = 15.10 No fix listed
Canonical Ubuntu Linux = 16.04 No fix listed
debian linux = 7.0 No fix listed
debian linux = 8.0 No fix listed

References