CVE-2012-4431: CSRF
org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.
Other sources
The CSRF prevention filter could be bypassed if a request was made to a protected resource without a session identifier present in the request.
Source: Tomcat security pages. [1,2]
[1] http://tomcat.apache.org/security-6.html [2] http://tomcat.apache.org/security-7.html
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4431?
The severity of CVE-2012-4431 is moderate as it allows Cross-Site Request Forgery (CSRF) attacks by bypassing the CSRF prevention filter.
How do I fix CVE-2012-4431?
To fix CVE-2012-4431, update Apache Tomcat to version 6.0.36 or higher, or version 7.0.32 or higher.
Which versions of Apache Tomcat are affected by CVE-2012-4431?
Apache Tomcat versions prior to 6.0.36 and 7.0.32 are affected by CVE-2012-4431.
What kind of attack does CVE-2012-4431 facilitate?
CVE-2012-4431 facilitates Cross-Site Request Forgery (CSRF) attacks by allowing unauthorized requests to be executed without a valid session identifier.
Is CVE-2012-4431 specific to any particular operating system?
CVE-2012-4431 is specific to Apache Tomcat and is not limited to any particular operating system.