CVE-2015-5346

CVE-2015-5346

High · published February 25, 2016

CVSS v3.0
8.1
EPSS
11%
Percentile
95.8
In the wild
Unconfirmed
What it is

Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.

The record
Technical detail
CVSS v3.0
8.1 · HIGH
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.10573 · 95.8th percentile
Published
2016-02-25T06:59Z
Affected products (72)
ProductVersionsFixed in
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
apache/tomcatall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
References (70)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html · [email protected]http://packetstormsecurity.com/files/135890/Apache-Tomcat-Session-Fixation.html · [email protected]http://rhn.redhat.com/errata/RHSA-2016-1089.html · [email protected]http://rhn.redhat.com/errata/RHSA-2016-2046.html · [email protected]http://rhn.redhat.com/errata/RHSA-2016-2807.html · [email protected]http://rhn.redhat.com/errata/RHSA-2016-2808.html · [email protected]http://seclists.org/bugtraq/2016/Feb/143 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1713184 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1713185 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1713187 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1723414 · [email protected]http://svn.apache.org/viewvc?view=revision&revision=1723506 · [email protected]http://tomcat.apache.org/security-7.html · [email protected]http://tomcat.apache.org/security-8.html · [email protected]http://tomcat.apache.org/security-9.html · [email protected]http://www.debian.org/security/2016/dsa-3530 · [email protected]http://www.debian.org/security/2016/dsa-3552 · [email protected]http://www.debian.org/security/2016/dsa-3609 · [email protected]http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · [email protected]http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html · [email protected]http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html · [email protected]http://www.securityfocus.com/bid/83323 · [email protected]http://www.securitytracker.com/id/1035069 · [email protected]http://www.ubuntu.com/usn/USN-3024-1 · [email protected]https://access.redhat.com/errata/RHSA-2016:1087 · [email protected]https://access.redhat.com/errata/RHSA-2016:1088 · [email protected]https://bto.bluecoat.com/security-advisory/sa118 · [email protected]https://bz.apache.org/bugzilla/show_bug.cgi?id=58809 · [email protected]https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442 · [email protected]https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626 · [email protected]https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E · [email protected]https://security.gentoo.org/glsa/201705-09 · [email protected]https://security.netapp.com/advisory/ntap-20180531-0001/ · [email protected]http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html · af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/135890/Apache-Tomcat-Session-Fixation.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-1089.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-2046.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-2807.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-2808.html · af854a3a-2127-422b-91ae-364da2661108http://seclists.org/bugtraq/2016/Feb/143 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1713184 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1713185 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1713187 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1723414 · af854a3a-2127-422b-91ae-364da2661108http://svn.apache.org/viewvc?view=revision&revision=1723506 · af854a3a-2127-422b-91ae-364da2661108http://tomcat.apache.org/security-7.html · af854a3a-2127-422b-91ae-364da2661108http://tomcat.apache.org/security-8.html · af854a3a-2127-422b-91ae-364da2661108http://tomcat.apache.org/security-9.html · af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2016/dsa-3530 · af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2016/dsa-3552 · af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2016/dsa-3609 · af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html · af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/83323 · af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1035069 · af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-3024-1 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2016:1087 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2016:1088 · af854a3a-2127-422b-91ae-364da2661108https://bto.bluecoat.com/security-advisory/sa118 · af854a3a-2127-422b-91ae-364da2661108https://bz.apache.org/bugzilla/show_bug.cgi?id=58809 · af854a3a-2127-422b-91ae-364da2661108https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442 · af854a3a-2127-422b-91ae-364da2661108https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626 · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/201705-09 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20180531-0001/ · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 25 FEB 01:00Z
    Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for…
    cvelistv5