CVE-2015-5351 — Cross-Site Request Forgery in Apache Tomcat

CWE-352 — Cross-Site Request Forgery13 documents9 sources
Severity
8.8HIGHNVD
EPSS
2.3%
top 15.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Apache TomcatCanonical Ubuntu LinuxDebian Linux
Timeline
PublishedFeb 25
Latest updateMay 14

Description

The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages1 packages

▶NVDapache/tomcat65 versions+64

Also affects: Debian Linux 7.0, 8.0, Ubuntu Linux 12.04, 14.04, 15.10, 16.04

🔴Vulnerability Details

4
OSV
Apache Tomcat allows remote attackers to bypass a CSRF protection mechanism by using a token↗2022-05-14
▶
GHSA
Apache Tomcat allows remote attackers to bypass a CSRF protection mechanism by using a token↗2022-05-14
▶
CVEList
CVE-2015-5351: The (1) Manager and (2) Host Manager applications in Apache Tomcat 7↗2016-02-25
▶
OSV
CVE-2015-5351: The (1) Manager and (2) Host Manager applications in Apache Tomcat 7↗2016-02-24
▶

📋Vendor Advisories

4
Ubuntu
Tomcat vulnerabilities↗2016-07-05
▶
Red Hat
tomcat: CSRF token leak↗2016-02-22
▶
Debian
CVE-2015-5351: tomcat9 - The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7....↗2015
▶
Apache
Apache tomcat: CVE-2015-5351↗
▶

💬Community

4
Bugzilla
CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 CVE-2016-3092 tomcat: multiple security vulnerabilities [epel-6]↗2016-07-01
▶
Bugzilla
CVE-2015-5351 tomcat: CSRF token leak↗2016-02-23
▶
Bugzilla
CVE-2015-5174 CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 tomcat: multiple security vulnerabilities [epel-6]↗2016-02-23
▶
Bugzilla
CVE-2015-5174 CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 tomcat: multiple security vulnerabilities [fedora-all]↗2016-02-23
▶
CVE-2015-5351 — Cross-Site Request Forgery in Apache | cvebase