CVE-2019-17563

 

Published at: - 23-12-2019 06:15

Last modified: - 07-10-2022 03:39

Total changes: - 4

Description

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://lists.apache.org/thread.html/8b4c1db8300117b28a0f3f743c0b9e3f964687a690cdf9662a884bbd%40%3Cannounce.tomcat.apache.org%3E
• DSA-4596-Third Party Advisory
• 20191229 [SECURITY] [DSA 4596-1] tomcat8 security update-Mailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20200107-0001/
• openSUSE-SU-2020:0038-Third Party Advisory
• [debian-lts-announce] 20200127 [SECURITY] [DLA 2077-1] tomcat7 security update-Third Party Advisory
• USN-4251-1-Third Party Advisory
• [tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/-Mailing List, Patch, Vendor Advisory
• [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/-Mailing List, Patch, Vendor Advisory
• [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/-Mailing List, Patch, Vendor Advisory
• [tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/-Mailing List, Patch, Vendor Advisory
• [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/-Mailing List, Patch, Vendor Advisory
• GLSA-202003-43-Third Party Advisory
• N/A-Patch, Third Party Advisory
• DSA-4680-Third Party Advisory
• [debian-lts-announce] 20200528 [SECURITY] [DLA 2209-1] tomcat8 security update-Mailing List, Third Party Advisory
• [cxf-issues] 20200618 [jira] [Created] (FEDIZ-249) Relying party rejects a valid security token and redirects back to ADFS when using Fediz 1.4.6 with Tomcat 8.5.56-Mailing List, Patch, Vendor Advisory
• https://www.oracle.com/security-alerts/cpujul2020.html
• https://www.oracle.com/security-alerts/cpujan2021.html

 

Keywords

NVD

 

CVE-2019-17563

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures