CVE-2013-2067 in Communications Policy Management

요약 (영어)

java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a session fixation attack.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

예약하다

2013. 02. 19.

공개

2013. 06. 01.

상태

확인됨

엔트리

VulDB provides additional information and datapoints for this CVE:

아이디	취약성	CWE	악용	대책	CVE
92886	Oracle Communications Policy Management Tomcat 약한 인증	287	정의되지 않음	공식 수정	CVE-2013-2067
92870	Oracle Communications Policy Management Tomcat 약한 인증	287	정의되지 않음	공식 수정	CVE-2013-2067
11922	Oracle Secure Global Desktop Apache Tomcat 약한 인증	287	정의되지 않음	공식 수정	CVE-2013-2067
11846	Oracle Transportation Management Application Server 약한 인증	287	정의되지 않음	공식 수정	CVE-2013-2067
8664	Apache Tomcat FORM Authentication 약한 인증	287	정의되지 않음	공식 수정	CVE-2013-2067

출처

• MITRE
• NVD
• CVE Details