CVE-2015-5346: Session Fixation Vulnerability in Apache Tomcat

org.apache.tomcat:tomcat Updated 02 Oct 2025

Summary

14/05/2022

Disclosed on

CVE-2015-5346

CVE

Yes i

Fix available

High

Severity

8.1

CVSS Score

CVE-2015-5346: Improper Neutralization of Input During Web Page Generation in Apache Tomcat. Affects org.apache.tomcat:tomcat across 3 version ranges.

>= 7.0.0, < 7.0.66 >= 8.0.0.RC1, < 8.0.31 >= 9.0.0.M1, < 9.0.0.M2

Fixed in 7.0.66, 8.0.31 or 9.0.0.M2, depending on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running web applications and supports the Java Servlet, JavaServer Pages (JSP), and WebSocket technologies. This vulnerability affects versions 7.x, 8.x, and 9.x of Apache Tomcat. The vulnerability allows remote attackers to hijack web sessions by exploiting the use of a requestedSessionSSL field for unintended requests.

Vulnerability Detail

The session fixation vulnerability in Apache Tomcat arises when different session settings are used for deployments of multiple versions of the same web application. This vulnerability can be exploited by remote attackers to hijack web sessions. By leveraging the use of a requestedSessionSSL field for an unintended request, an attacker can fixate a user's session and gain unauthorized access to sensitive information or perform malicious actions on behalf of the victim. The vulnerability is present in the CoyoteAdapter.java and Request.java files.

How To Fix

Fixed versions by release line

The minimum fixed version depends on the release line you run.

>= 7.0.0, < 7.0.66 7.0.66
>= 8.0.0.RC1, < 8.0.31 8.0.31
>= 9.0.0.M1, < 9.0.0.M2 9.0.0.M2

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

If upgrading to a patched version is not immediately feasible, a possible workaround is to ensure that only one version of the web application is deployed at a time. By avoiding the use of multiple versions with different session settings, the risk of session fixation can be mitigated. Additionally, implementing strong session management practices, such as regenerating session IDs upon authentication or session timeout, can help reduce the impact of session fixation attacks.

Conclusion

The session fixation vulnerability in Apache Tomcat can have serious security implications, allowing attackers to hijack web sessions and gain unauthorized access to sensitive information. It is crucial to upgrade to the patched versions of Apache Tomcat or implement the recommended workarounds to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.

See every vulnerability recorded for org.apache.tomcat:tomcat →

FAQ

What is session fixation?

Session fixation is an attack technique where an attacker fixes or sets the session identifier (SID) of a user's session to a known value. This allows the attacker to hijack the user's session and gain unauthorized access to the application.

How does this vulnerability affect Apache Tomcat?

This vulnerability affects Apache Tomcat versions 7.x, 8.x, and 9.x. It allows remote attackers to hijack web sessions by exploiting the use of a requestedSessionSSL field for unintended requests.

What are the potential consequences of this vulnerability?

The session fixation vulnerability in Apache Tomcat can lead to unauthorized access to sensitive information, such as user credentials or personal data. Attackers can also perform malicious actions on behalf of the victim, potentially causing financial loss or reputational damage.

Are there any known mitigations for this vulnerability?

Yes, upgrading to Apache Tomcat version 7.0.66, 8.0.31, or 9.0.0.M2 includes the necessary patches to mitigate the session fixation vulnerability. Implementing strong session management practices, such as regenerating session IDs upon authentication or session timeout, can also help reduce the impact of session fixation attacks.

How can I check if my Apache Tomcat installation is affected by this vulnerability?

You can use Vulert's playground (https://vulert.com/scanner) to check if your Apache Tomcat installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file to provide vulnerability information without requiring access to the code or installation.