Published: 19/12/2012 Updated: 19/09/2017

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 384

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x prior to 6.0.36 and 7.x prior to 7.0.32 allows remote malicious users to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache tomcat 6.0.15
apache tomcat 6.0.8
apache tomcat 6.0.9
apache tomcat 6.0.4
apache tomcat 6.0.28
apache tomcat 6.0.1
apache tomcat 6.0.0
apache tomcat 6.0.32
apache tomcat 6.0.13
apache tomcat 6.0.24
apache tomcat 6.0.16
apache tomcat 6.0.14
apache tomcat 6.0.6
apache tomcat 6.0.29
apache tomcat 6.0.7
apache tomcat 6.0.17
apache tomcat 6.0.27
apache tomcat 6.0.3
apache tomcat 6.0.11
apache tomcat 6.0.10
apache tomcat 6.0.30
apache tomcat 6.0
apache tomcat 6.0.35
apache tomcat 6.0.2
apache tomcat 6.0.5
apache tomcat 6.0.31
apache tomcat 6.0.12
apache tomcat 6.0.33
apache tomcat 6.0.18
apache tomcat 6.0.26
apache tomcat 6.0.20
apache tomcat 6.0.19
apache tomcat 7.0.23
apache tomcat 7.0.2
apache tomcat 7.0.6
apache tomcat 7.0.21
apache tomcat 7.0.17
apache tomcat 7.0.14
apache tomcat 7.0.28
apache tomcat 7.0.12
apache tomcat 7.0.9
apache tomcat 7.0.8
apache tomcat 7.0.13
apache tomcat 7.0.5
apache tomcat 7.0.1
apache tomcat 7.0.20
apache tomcat 7.0.0
apache tomcat 7.0.3
apache tomcat 7.0.19
apache tomcat 7.0.22
apache tomcat 7.0.4
apache tomcat 7.0.16
apache tomcat 7.0.7
apache tomcat 7.0.18
apache tomcat 7.0.15
apache tomcat 7.0.10
apache tomcat 7.0.11
apache tomcat 7.0.25
apache tomcat 7.0.30

Debian Bug report logs - #695250 tomcat6: CVE-2012-4534 CVE-2012-4431 CVE-2012-3546 Package: tomcat6; Maintainer for tomcat6 is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@inutilorg> Date: Thu, 6 Dec 2012 07:48:01 UTC Severity: grave Tags: security F ...

Several security issues were fixed in Tomcat ...

Synopsis Moderate: tomcat7 security update Type/Severity Security Advisory: Moderate Topic Updated tomcat7 packages that fix one security issue are now available forJBoss Enterprise Web Server 200 for Red Hat Enterprise Linux 5 and 6The Red Hat Security Response Team has rated this update as having moder ...

Synopsis Moderate: jbossweb security update Type/Severity Security Advisory: Moderate Topic Updated jbossweb packages for JBoss Enterprise Application Platform 601that fix multiple security issues are now available for Red Hat EnterpriseLinux 5 and 6The Red Hat Security Response Team has rated this updat ...

Synopsis Moderate: tomcat6 security update Type/Severity Security Advisory: Moderate Topic Updated tomcat6 packages that fix multiple security issues are nowavailable for JBoss Enterprise Web Server 200 for Red Hat EnterpriseLinux 5 and 6The Red Hat Security Response Team has rated this update as having ...

Synopsis Moderate: tomcat6 security update Type/Severity Security Advisory: Moderate Topic An update for the Apache Tomcat 6 component for JBoss Enterprise Web Server200 that fixes multiple security issues is now available from the Red HatCustomer PortalThe Red Hat Security Response Team has rated this u ...

Synopsis Moderate: tomcat7 security update Type/Severity Security Advisory: Moderate Topic An update for the Apache Tomcat 7 component for JBoss Enterprise Web Server200 that fixes one security issue is now available from the Red HatCustomer PortalThe Red Hat Security Response Team has rated this update ...

CWE-264 http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/filters/CsrfPreventionFilter.java?r1=1393088&r2=1393087&pathrev=1393088 http://svn.apache.org/viewvc?view=revision&revision=1393088 http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml?r1=1393088&r2=1393087&pathrev=1393088 http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-7.html http://archives.neohapsis.com/archives/bugtraq/2012-12/0045.html http://lists.opensuse.org/opensuse-updates/2013-01/msg00051.html http://www.ubuntu.com/usn/USN-1685-1 http://lists.opensuse.org/opensuse-updates/2013-01/msg00080.html http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html http://rhn.redhat.com/errata/RHSA-2013-0268.html http://rhn.redhat.com/errata/RHSA-2013-0267.html http://www.securitytracker.com/id?1027834 http://rhn.redhat.com/errata/RHSA-2013-0647.html http://rhn.redhat.com/errata/RHSA-2013-0648.html https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03748878 http://rhn.redhat.com/errata/RHSA-2013-1437.html http://rhn.redhat.com/errata/RHSA-2013-1853.html http://marc.info/?l=bugtraq&m=139344343412337&w=2 http://secunia.com/advisories/57126 http://marc.info/?l=bugtraq&m=136612293908376&w=2 http://www.securityfocus.com/bid/56814 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18541 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=695250 https://usn.ubuntu.com/1685-1/https://nvd.nist.gov

CVE-2012-4431

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect