CVE-2019-17563: Apache Tomcat Session Fixation Vulnerability
Summary
CVE-2019-17563: When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. Affects org.apache.tomcat.embed:tomcat-embed-core across 3 version ranges.
< 7.0.99
>= 8.0.0, < 8.5.50
>= 9.0.0, < 9.0.30
Fixed in 7.0.99, 8.5.50 or 9.0.30, depending on the release line you run. How to fix ↓
Also tracked for
- tomcat9 · Debian:11
The same CVE-2019-17563 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications. The tomcat-embed-core package is a Maven package that allows embedding Apache Tomcat into other applications. This vulnerability affects versions 7.0.0 to 7.0.98, 8.5.0 to 8.5.49, and 9.0.0.M1 to 9.0.29 of the tomcat-embed-core package.
Vulnerability Detail
The vulnerability in Apache Tomcat allows an attacker to perform a session fixation attack when using FORM authentication. This means that an attacker can manipulate the session identifier of a user, potentially gaining unauthorized access to their account or performing malicious actions on their behalf. Although the window of opportunity for exploitation is narrow, it has been treated as a security vulnerability due to the potential impact.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 7.0.997.0.99 -
>= 8.0.0, < 8.5.508.5.50 -
>= 9.0.0, < 9.0.309.0.30
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The Apache Tomcat session fixation vulnerability (CVE-2019-17563) can potentially allow attackers to gain unauthorized access to user accounts. It is recommended to upgrade to the fixed versions of the tomcat-embed-core package to mitigate this vulnerability. For further assistance and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat.embed:tomcat-embed-core →
FAQ
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications.
Session fixation is an attack where an attacker sets the session identifier of a user to a known value, potentially gaining unauthorized access to their account.
FORM authentication is a method of user authentication in web applications where users enter their credentials in a form.
This vulnerability could allow an attacker to gain unauthorized access to user accounts or perform malicious actions on their behalf.
To fix this vulnerability, upgrade to a fixed version of the tomcat-embed-core package as mentioned in the 'how_to_fix' section.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat.embed:tomcat-embed-core.
