High · published December 23, 2019
When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.
| Product | Versions | Fixed in |
|---|---|---|
| apache/tomcat | ≥ 7.0.0, ≤ 7.0.98 | — |
| apache/tomcat | ≥ 8.5.0, ≤ 8.5.49 | — |
| apache/tomcat | ≥ 9.0.0, ≤ 9.0.29 | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| opensuse/leap | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| oracle/agile_engineering_data_management | all versions | — |
| oracle/hyperion_infrastructure_technology | all versions | — |
| oracle/instantis_enterprisetrack | ≥ 17.1, ≤ 17.3 | — |
| oracle/micros_relate_crm_software | all versions | — |
| oracle/mysql_enterprise_monitor | ≤ 4.0.11.5331 | — |
| oracle/mysql_enterprise_monitor | ≥ 8.0.0, ≤ 8.0.18.1217 | — |
| oracle/retail_order_broker | all versions | — |
| oracle/transportation_management | all versions | — |