NetSight
IP …
high7.5

CVE-2019-17563

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could per…

Impact

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.

Affected products

VendorProductAffected versions
ApacheTomcat
from 7.0.0 through 7.0.98
from 8.5.0 through 8.5.49
from 9.0.0 through 9.0.29
DebianDebian Linux
Versions 8.0, 9.0, 10.0
OpensuseLeap
Version 15.1
CanonicalUbuntu Linux
Version 16.04
OracleAgile Engineering Data Management
Version 6.2.1.0
OracleHyperion Infrastructure Technology
Version 11.1.2.4
OracleInstantis Enterprisetrack
from 17.1 through 17.3
OracleMicros Relate Crm Software
Version 11.4
OracleMysql Enterprise Monitor
through 4.0.11.5331
from 8.0.0 through 8.0.18.1217
OracleRetail Order Broker
Version 15.0
OracleTransportation Management
Version 6.3.7

Weakness classification

CWE-384

References