CVE-2019-17563

HIGH Year: 2019
CVSS v3 Score
7.5
High
CVSS v2 Score
5.1
Medium
Weakness Type
CWE-384
View all →

Vulnerability Description

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.

Related Vulnerabilities

CVE-2010-1434

HIGH
CVSS:7.5(High)

Joomla! Core is prone to a session fixation vulnerability. An attacker may leverage this issue to hijack an arbitrary session and gain access to sensitive information, which may help in launching furt...

CWE-3842010

CVE-2013-2049

HIGH
CVSS:7.5(High)

Red Hat CloudForms 2 Management Engine (CFME) allows remote attackers to conduct session tampering attacks by leveraging use of a static secret_token.rb secret.

CWE-3842013

CVE-2013-4572

HIGH
CVSS:7.5(High)

The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows ...

CWE-3842013

CVE-2017-18125

HIGH
CVSS:7.5(High)

In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 835, SD 845, SD 850, when secure camera is activ...

CWE-3842017

CVE-2017-5656

HIGH
CVSS:7.5(High)

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an i...

CWE-3842017

CVE-2018-1375

HIGH
CVSS:7.5(High)

IBM Security Guardium Big Data Intelligence (SonarG) 3.1 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could fo...

CWE-3842018