Vulnerability in Apache Tomcat
CVE-2019-17563
When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.107 (95.7th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 95.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.107 · newest: 0.107 · change: 0.000
Affected products
- Apache Tomcat
- Apache Software Foundation Tomcat — versions 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49, 7.0.0 to 7.0.98
- Oracle Agile Engineering Data Management — versions 6.2.1.0
- Oracle Hyperion Infrastructure Technology — versions 11.1.2.4
- Oracle Instantis Enterprisetrack
- Oracle Micros Relate Crm Software — versions 11.4
- Oracle MySQL Enterprise Monitor
- Oracle Retail Order Broker — versions 15.0
- Oracle Transportation Management — versions 6.3.7
- Canonical Ubuntu Linux — versions 16.04
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.debian.org/security/2019/dsa-4596 (vendor-advisory, Third Party Advisory)
- seclists.org/bugtraq/2019/Dec/43 (mailing-list, Mailing List, Third Party Advisory)
- lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html (vendor-advisory, Third Party Advisory)
- lists.debian.org/debian-lts-announce/2020/01/msg00024.html (mailing-list, Third Party Advisory)
- usn.ubuntu.com/4251-1/ (vendor-advisory, Third Party Advisory)
- lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7… (mailing-list)
- lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225… (mailing-list)
- lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2c… (mailing-list)
- lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b11… (mailing-list)
- lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099e… (mailing-list)
Frequently asked questions
- What is CVE-2019-17563?
- CVE-2019-17563 is a high-severity vulnerability in Apache Tomcat, classified under Session Fixation. CVSS score: 7.5/10. Published 2019-12-23.
- How severe is CVE-2019-17563?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2019-17563 known to be exploited?
- 8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.