NVD

Id
26535  
Name
CVE-2015-5351  
Description
The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-02-24  
Modified Date
2016-12-05  
Seq
2015-5351  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
140424 26535 CVE-2015-5351 SUSE-SU-2016:0769  View
140425 26535 CVE-2015-5351 SUSE-SU-2016:0822  View
140426 26535 CVE-2015-5351 openSUSE-SU-2016:0865  View
140427 26535 CVE-2015-5351 http://packetstormsecurity.com/files/135882/Apache-Tomcat-CSRF-Token-Leak.html  View
140428 26535 CVE-2015-5351 RHSA-2016:1089  View
140429 26535 CVE-2015-5351 20160222 [SECURITY] CVE-2015-5351 Apache Tomcat CSRF token leak  View
140430 26535 CVE-2015-5351 http://svn.apache.org/viewvc?view=revision&revision=1720652  View
140431 26535 CVE-2015-5351 http://svn.apache.org/viewvc?view=revision&revision=1720655  View
140432 26535 CVE-2015-5351 http://svn.apache.org/viewvc?view=revision&revision=1720658  View
140433 26535 CVE-2015-5351 http://svn.apache.org/viewvc?view=revision&revision=1720660  View
140434 26535 CVE-2015-5351 http://svn.apache.org/viewvc?view=revision&revision=1720661  View
140435 26535 CVE-2015-5351 http://svn.apache.org/viewvc?view=revision&revision=1720663  View
140436 26535 CVE-2015-5351 http://tomcat.apache.org/security-7.html  View
140437 26535 CVE-2015-5351 http://tomcat.apache.org/security-8.html  View
140438 26535 CVE-2015-5351 http://tomcat.apache.org/security-9.html  View
140439 26535 CVE-2015-5351 DSA-3530  View
140440 26535 CVE-2015-5351 DSA-3552  View
140441 26535 CVE-2015-5351 DSA-3609  View
140442 26535 CVE-2015-5351 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html  View
140443 26535 CVE-2015-5351 83330  View
140444 26535 CVE-2015-5351 1035069  View
140445 26535 CVE-2015-5351 USN-3024-1  View
140446 26535 CVE-2015-5351 RHSA-2016:1087  View
140447 26535 CVE-2015-5351 RHSA-2016:1088  View
140448 26535 CVE-2015-5351 https://bto.bluecoat.com/security-advisory/sa118  View
140449 26535 CVE-2015-5351 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442  View
140450 26535 CVE-2015-5351 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
11605 JVNDB-2015-006925 Apache Tomcat の Manager および Host Manager アプリケーションにおける CSRF 保護メカニズムを回避される脆弱性 Apache Tomcat の (1) Manager および (2) Host Manager アプリケーションは、セッションを確立し、任意の新しいリクエストに CSRF トークンを送信するため、CSRF 保護メカニズムを回避される脆弱性が存在します。 CVE-2015-5351 82576 CVE-2015-5351 26535 6.8 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-006925.html 2015-12-17 2016-06-24 View