CVE-2015-5346 : Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.

Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.

Published 2016-02-25 01:59:02

Updated 2023-12-08 16:41:19

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2015-5346

Debian » Debian Linux » Version: 7.0
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.0 Update Beta
cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.6
cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.11
cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.10
cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.12
cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.14
cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.19
cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.16
cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.20
cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.21
cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.22
cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.4 Update Beta
cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.23
cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.25
cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.2 Update Beta
cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.28
cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.30
cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.32
cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.33
cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.34
cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.26
cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.27
cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.40
cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.41
cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.42
cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.35
cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.47
cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.29
cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.37
cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.39
cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.50
cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 8.0.0 Update RC5
cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 8.0.0 Update RC1
cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 8.0.0 Update RC3
cpe:2.3:a:apache:tomcat:8.0.0:rc3:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.52
cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 8.0.1
cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 8.0.0 Update Rc10
cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 8.0.3
cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.53
cpe:2.3:a:apache:tomcat:7.0.53:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.54
cpe:2.3:a:apache:tomcat:7.0.54:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.55
cpe:2.3:a:apache:tomcat:7.0.55:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.56
cpe:2.3:a:apache:tomcat:7.0.56:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 8.0.12
cpe:2.3:a:apache:tomcat:8.0.12:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 8.0.14
cpe:2.3:a:apache:tomcat:8.0.14:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.57
cpe:2.3:a:apache:tomcat:7.0.57:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 8.0.15
cpe:2.3:a:apache:tomcat:8.0.15:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 8.0.11
cpe:2.3:a:apache:tomcat:8.0.11:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.59
cpe:2.3:a:apache:tomcat:7.0.59:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.61
cpe:2.3:a:apache:tomcat:7.0.61:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.63
cpe:2.3:a:apache:tomcat:7.0.63:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.65
cpe:2.3:a:apache:tomcat:7.0.65:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.62
cpe:2.3:a:apache:tomcat:7.0.62:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.64
cpe:2.3:a:apache:tomcat:7.0.64:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 8.0.17
cpe:2.3:a:apache:tomcat:8.0.17:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 8.0.26
cpe:2.3:a:apache:tomcat:8.0.26:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 8.0.29
cpe:2.3:a:apache:tomcat:8.0.29:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 8.0.28
cpe:2.3:a:apache:tomcat:8.0.28:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 7.0.5 Update Beta
cpe:2.3:a:apache:tomcat:7.0.5:beta:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 8.0.18
cpe:2.3:a:apache:tomcat:8.0.18:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 8.0.20
cpe:2.3:a:apache:tomcat:8.0.20:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 8.0.23
cpe:2.3:a:apache:tomcat:8.0.23:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 8.0.24
cpe:2.3:a:apache:tomcat:8.0.24:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 8.0.27
cpe:2.3:a:apache:tomcat:8.0.27:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 8.0.21
cpe:2.3:a:apache:tomcat:8.0.21:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 8.0.22
cpe:2.3:a:apache:tomcat:8.0.22:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 9.0.0 Update Milestone1
cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 15.10
cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 12.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 14.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 16.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Matching versions

Threat overview for CVE-2015-5346

Top countries where our scanners detected CVE-2015-5346

Top open port discovered on systems with this issue 80

IPs affected by CVE-2015-5346 62,435

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2015-5346!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2015-5346

EPSS FAQ

0.94%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 81 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-5346

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.1	HIGH	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	2.2	5.9	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2015-5346

http://tomcat.apache.org/security-8.html

Apache Tomcat® - Apache Tomcat 8 vulnerabilities
Vendor Advisory

CVEs referencing this url
http://www.securitytracker.com/id/1035069

Apache Tomcat Bugs Let Remote Users Bypass Security Restrictions, Hijack Sessions, and Obtain Potentially Sensitive Information - SecurityTracker

CVEs referencing this url
https://bto.bluecoat.com/security-advisory/sa118

SA118 : February 2016 Apache Tomcat Vulnerabilities

CVEs referencing this url
https://bz.apache.org/bugzilla/show_bug.cgi?id=58809

58809 – Session info missing in request when using parallel deployment
https://access.redhat.com/errata/RHSA-2016:1087

RHSA-2016:1087 - Security Advisory - Red Hat Customer Portal

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html

[security-announce] openSUSE-SU-2016:0865-1: important: Security update

CVEs referencing this url
http://seclists.org/bugtraq/2016/Feb/143

Bugtraq: [SECURITY] CVE-2015-5346 Apache Tomcat Session fixation
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E

Apache Mail Archives

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2016:1088

RHSA-2016:1088 - Security Advisory - Red Hat Customer Portal

CVEs referencing this url
http://tomcat.apache.org/security-7.html

Apache Tomcat® - Apache Tomcat 7 vulnerabilities
Vendor Advisory

CVEs referencing this url
http://www.debian.org/security/2016/dsa-3609

Debian -- Security Information -- DSA-3609-1 tomcat8

CVEs referencing this url
http://svn.apache.org/viewvc?view=revision&revision=1723414

[Apache-SVN] Revision 1723414
http://svn.apache.org/viewvc?view=revision&revision=1713187

[Apache-SVN] Revision 1713187
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

Oracle Linux Bulletin - October 2016

CVEs referencing this url
http://svn.apache.org/viewvc?view=revision&revision=1723506

[Apache-SVN] Revision 1723506
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html

[security-announce] SUSE-SU-2016:0769-1: important: Security update for

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3024-1

USN-3024-1: Tomcat vulnerabilities | Ubuntu security notices

CVEs referencing this url
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626

HPSBOV03615 rev.1 - HPE OpenVMS CSWS running the Apache Tomcat 7 Servlet Engine, Multiple Remote Vulnerabilities

CVEs referencing this url
https://security.gentoo.org/glsa/201705-09

Apache Tomcat: Multiple vulnerabilities (GLSA 201705-09) — Gentoo security

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2016-2808.html

RHSA-2016:2808 - Security Advisory - Red Hat Customer Portal

CVEs referencing this url
http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

Oracle Solaris Bulletin - January 2016

CVEs referencing this url
http://tomcat.apache.org/security-9.html

Apache Tomcat® - Apache Tomcat 9 vulnerabilities
Vendor Advisory

CVEs referencing this url
http://www.debian.org/security/2016/dsa-3530

Debian -- Security Information -- DSA-3530-1 tomcat6

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html

[security-announce] SUSE-SU-2016:0822-1: important: Security update for

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2016-2046.html

RHSA-2016:2046 - Security Advisory - Red Hat Customer Portal

CVEs referencing this url
http://www.securityfocus.com/bid/83323

Apache Tomcat CVE-2015-5346 Session Fixation Vulnerability
http://svn.apache.org/viewvc?view=revision&revision=1713185

[Apache-SVN] Revision 1713185
http://rhn.redhat.com/errata/RHSA-2016-1089.html

Red Hat Customer Portal

CVEs referencing this url
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

CPU July 2018

CVEs referencing this url
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E

svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ - Pony Mail

CVEs referencing this url
http://svn.apache.org/viewvc?view=revision&revision=1713184

[Apache-SVN] Revision 1713184
http://rhn.redhat.com/errata/RHSA-2016-2807.html

RHSA-2016:2807 - Security Advisory - Red Hat Customer Portal

CVEs referencing this url
http://www.debian.org/security/2016/dsa-3552

Debian -- Security Information -- DSA-3552-1 tomcat7

CVEs referencing this url
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442

HPSBUX03606 rev.1 - HPE HP-UX running Apache Tomcat 7, Multiple Remote Vulnerabilities

CVEs referencing this url
http://packetstormsecurity.com/files/135890/Apache-Tomcat-Session-Fixation.html

Apache Tomcat Session Fixation ≈ Packet Storm
https://security.netapp.com/advisory/ntap-20180531-0001/

February 2016 Apache Tomcat Vulnerabilities in NetApp Products | NetApp Product Security

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2015-5346

Products affected by CVE-2015-5346

Threat overview for CVE-2015-5346

Exploit prediction scoring system (EPSS) score for CVE-2015-5346

CVSS scores for CVE-2015-5346

References for CVE-2015-5346