CVE-2019-17563

Published: Dec 23, 2019Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.6 / Impact: 5.9

Source: NVD

Description

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.

Affected (16)

Products: Apache: Tomcat · Debian: Debian Linux · Opensuse: Leap · +2 more

Show all products

Apache: Tomcat · Debian: Debian Linux · Opensuse: Leap · Canonical: Ubuntu Linux · Oracle: Agile Engineering Data Management, Hyperion Infrastructure Technology, Instantis Enterprisetrack, Micros Relate Crm Software, Mysql Enterprise Monitor, Retail Order Broker, Transportation Management

1 product

1 product

1 product

1 product

7 products

Agile Engineering Data Management

Hyperion Infrastructure Technology

Instantis Enterprisetrack

Micros Relate Crm Software

Mysql Enterprise Monitor

Retail Order Broker

Transportation Management

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	From 7.0.0 to 7.0.98
Apache Tomcat	From 8.5.0 to 8.5.49
Apache Tomcat	From 9.0.0 to 9.0.29

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04

Configuration E

8 vulnerable

Vulnerable Software	Affected Versions
Oracle Agile Engineering Data Management	Version 6.2.1.0
Oracle Hyperion Infrastructure Technology	Version 11.1.2.4
Oracle Instantis Enterprisetrack	From 17.1 to 17.3
Oracle Micros Relate Crm Software	Version 11.4
Oracle Mysql Enterprise Monitor	Up to 4.0.11.5331
Oracle Mysql Enterprise Monitor	From 8.0.0 to 8.0.18.1217
Oracle Retail Order Broker	Version 15.0
Oracle Transportation Management	Version 6.3.7

Related CWEs

Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References (38)

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html

Source: security@apache.org

Third Party Advisory

https://lists.apache.org/thread.html/8b4c1db8300117b28a0f3f743c0b9e3f964687a690cdf9662a884bbd%40%3Cannounce.tomcat.apache.org%3E

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/reb9a66f176df29b9a832caa95ebd9ffa3284e8f4922ec4fa3ad8eb2e%40%3Cissues.cxf.apache.org%3E

Source: security@apache.org

https://lists.debian.org/debian-lts-announce/2020/01/msg00024.html

Source: security@apache.org

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html

Source: security@apache.org

Mailing ListThird Party Advisory

https://seclists.org/bugtraq/2019/Dec/43

Source: security@apache.org

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/202003-43

Source: security@apache.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20200107-0001/

Source: security@apache.org

Third Party Advisory

https://usn.ubuntu.com/4251-1/

Source: security@apache.org

Third Party Advisory

https://www.debian.org/security/2019/dsa-4596

Source: security@apache.org

Third Party Advisory

https://www.debian.org/security/2020/dsa-4680

Source: security@apache.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Source: security@apache.org

PatchThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lists.apache.org/thread.html/8b4c1db8300117b28a0f3f743c0b9e3f964687a690cdf9662a884bbd%40%3Cannounce.tomcat.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/reb9a66f176df29b9a832caa95ebd9ffa3284e8f4922ec4fa3ad8eb2e%40%3Cissues.cxf.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2020/01/msg00024.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://seclists.org/bugtraq/2019/Dec/43

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/202003-43

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.netapp.com/advisory/ntap-20200107-0001/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/4251-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2019/dsa-4596

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2020/dsa-4680

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.