CVE-2015-5351
The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token.
- CVSS 3.0
- 8.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS
- 9.7% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-25)
- CWE
- CWE-352
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:tomcat
- canonical:ubuntu_linux
- debian:debian_linux
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-w7cg-5969-678w | Maven | org.apache.tomcat:tomcat | <7.0.68 | 7.0.68 |
| GHSA-w7cg-5969-678w | Maven | org.apache.tomcat:tomcat | >=8.0.0 <8.0.31 | 8.0.31 |
| GHSA-w7cg-5969-678w | Maven | org.apache.tomcat:tomcat | >=9.0.0.M0 <9.0.0.M2 | 9.0.0.M2 |
References
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html
- http://packetstormsecurity.com/files/135882/Apache-Tomcat-CSRF-Token-Leak.html
- http://rhn.redhat.com/errata/RHSA-2016-1089.html