CVE-2013-2067: Improper Authentication in Apache Tomcat
Summary
CVE-2013-2067: Improper Authentication in Apache Tomcat. Affects org.apache.tomcat:tomcat across 2 version ranges.
>= 6.0.21, < 6.0.37
>= 7.0.0, < 7.0.33
Fixed in 6.0.37 or 7.0.33, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications. The vulnerability identified as CVE-2013-2067 affects Apache Tomcat versions 6.0.21 through 6.0.36 and 7.x before 7.0.33. This vulnerability is related to the form authentication feature in Apache Tomcat and involves improper handling of the relationships between authentication requirements and sessions.
Vulnerability Detail
The vulnerability allows remote attackers to inject a request into a session by sending the request during completion of the login form. This can lead to a session fixation attack, where an attacker can hijack a user's session and impersonate them. By injecting a request into the session, an attacker can potentially gain unauthorized access to sensitive information or perform actions on behalf of the user. The vulnerability has a moderate severity rating and is classified under CWE-287.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 6.0.21, < 6.0.376.0.37 -
>= 7.0.0, < 7.0.337.0.33
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a possible workaround is to disable form-based authentication or use an alternative authentication mechanism that is not affected by this vulnerability. However, it is strongly recommended to upgrade to the latest version of Apache Tomcat to ensure the security of the application.
Conclusion
The vulnerability identified as CVE-2013-2067 in Apache Tomcat can lead to session fixation attacks, allowing remote attackers to inject requests into sessions and potentially gain unauthorized access to sensitive information or perform actions on behalf of users. Users of Apache Tomcat are advised to upgrade to the latest version to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications.
The vulnerability affects Apache Tomcat versions 6.0.21 through 6.0.36 and 7.x before 7.0.33.
A session fixation attack is a type of attack where an attacker hijacks a user's session by injecting a request into the session during the authentication process.
This vulnerability has a moderate severity rating.
To mitigate the risk, it is recommended to upgrade to the latest version of Apache Tomcat (6.0.37 or later for Tomcat 6.x, and 7.0.33 or later for Tomcat 7.x).
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
