Improper input validation in Apache Tomcat

CVE-2014-0033

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.099 (95.1th percentile) — read the EPSS interpretation.

Affected products

  • Apache Tomcat — versions 6.0.33, 6.0.34, 6.0.35
  • N/a — versions n/a

Weakness classification (CWE)

References