When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.
CVE-2019-17563 - High Severity Vulnerability
Core Tomcat implementation
Library home page: https://tomcat.apache.org/
Path to dependency file: griffin/service/hibernate_mysql_pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/9.0.22/tomcat-embed-core-9.0.22.jar
Dependency Hierarchy: - spring-boot-starter-web-2.1.7.RELEASE.jar (Root Library) - spring-boot-starter-tomcat-2.1.7.RELEASE.jar - :x: **tomcat-embed-core-9.0.22.jar** (Vulnerable Library)
When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.
Publish Date: 2019-12-23
URL: CVE-2019-17563
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17563
Release Date: 2019-12-23
Fix Resolution: org.apache.tomcat.embed:tomcat-embed-core:7.0.99,8.5.50,9.0.30;org.apache.tomcat:tomcat-catalina:7.0.99,8.5.50,9.0.30