Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2013-6357 — Cross-Site Request Forgery in Apache Tomcat

CWE-352 — Cross-Site Request Forgery6 documents6 sources
Severity
6.8MEDIUMNVD
EPSS
1.3%
top 20.55%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Apache Tomcat
Timeline
PublishedNov 13
Latest updateMay 17

Description

Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI. NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as t…

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages1 packages

▶NVDapache/tomcat5.5.25+90

🔴Vulnerability Details

2
GHSA
GHSA-r22m-cc5w-vgh3: ** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5↗2022-05-17
▶
CVEList
CVE-2013-6357: Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5↗2013-11-13
▶

💥Exploits & PoCs

1
Exploit-DB
Apache Tomcat 5.5.25 - Cross-Site Request Forgery↗2013-11-04
▶

📋Vendor Advisories

1
Red Hat
tomcat5: CSRF vulnerability in Manager application↗2013-11-04
▶

💬Community

1
Bugzilla
CVE-2013-6357 tomcat5: CSRF vulnerability in Manager application↗2013-11-13
▶
CVE-2013-6357 — Cross-Site Request Forgery in Apache | cvebase