NVD

Id
26531  
Name
CVE-2015-5346  
Description
Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-02-24  
Modified Date
2016-12-05  
Seq
2015-5346  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
140385 26531 CVE-2015-5346 SUSE-SU-2016:0769  View
140386 26531 CVE-2015-5346 SUSE-SU-2016:0822  View
140387 26531 CVE-2015-5346 openSUSE-SU-2016:0865  View
140388 26531 CVE-2015-5346 http://packetstormsecurity.com/files/135890/Apache-Tomcat-Session-Fixation.html  View
140389 26531 CVE-2015-5346 RHSA-2016:1089  View
140390 26531 CVE-2015-5346 RHSA-2016:2046  View
140391 26531 CVE-2015-5346 20160222 [SECURITY] CVE-2015-5346 Apache Tomcat Session fixation  View
140392 26531 CVE-2015-5346 http://svn.apache.org/viewvc?view=revision&revision=1713184  View
140393 26531 CVE-2015-5346 http://svn.apache.org/viewvc?view=revision&revision=1713185  View
140394 26531 CVE-2015-5346 http://svn.apache.org/viewvc?view=revision&revision=1713187  View
140395 26531 CVE-2015-5346 http://svn.apache.org/viewvc?view=revision&revision=1723414  View
140396 26531 CVE-2015-5346 http://svn.apache.org/viewvc?view=revision&revision=1723506  View
140397 26531 CVE-2015-5346 http://tomcat.apache.org/security-7.html  View
140398 26531 CVE-2015-5346 http://tomcat.apache.org/security-8.html  View
140399 26531 CVE-2015-5346 http://tomcat.apache.org/security-9.html  View
140400 26531 CVE-2015-5346 DSA-3530  View
140401 26531 CVE-2015-5346 DSA-3552  View
140402 26531 CVE-2015-5346 DSA-3609  View
140403 26531 CVE-2015-5346 http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html  View
140404 26531 CVE-2015-5346 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html  View
140405 26531 CVE-2015-5346 83323  View
140406 26531 CVE-2015-5346 1035069  View
140407 26531 CVE-2015-5346 USN-3024-1  View
140408 26531 CVE-2015-5346 RHSA-2016:1087  View
140409 26531 CVE-2015-5346 RHSA-2016:1088  View
140410 26531 CVE-2015-5346 https://bto.bluecoat.com/security-advisory/sa118  View
140411 26531 CVE-2015-5346 https://bz.apache.org/bugzilla/show_bug.cgi?id=58809  View
140412 26531 CVE-2015-5346 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442  View
140413 26531 CVE-2015-5346 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
11604 JVNDB-2015-006924 Apache Tomcat における Web セッションをハイジャックされる脆弱性 Apache Tomcat には、同一の Web アプリケーションの複数バージョンの配置に異なるセッション設定が使用される場合、CoyoteAdapter.java および Request.java に関する処理に不備があるため、Web セッションをハイジャックされる脆弱性が存在します。 CVE-2015-5346 82571 CVE-2015-5346 26531 6.8 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-006924.html 2015-12-10 2016-12-05 View