CVE-2013-2067: Medium severity tomcat vulnerability
A session fixation flaw was found in the way FormAuthenticator module of Apache Tomcat, an Apache Servlet/JSP Engine, performed authentication requests management in certain circumstances (the most recent authentication request was associated with current user's session). An attacker could use this flaw to inject (and possibly successfully to complete) an authentication request, that would be executed using the credentials of the victim.
Relevant upstream patch: for Apache Tomcat 6.x: http://svn.apache.org/viewvc?view=revision&revision=1417891 for Apache Tomcat 7.x: http://svn.apache.org/viewvc?view=rev&rev=1408044
Other sources
java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a session fixation attack.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2067?
CVE-2013-2067 has a severity rating of medium, indicating a moderate risk to users.
How do I fix CVE-2013-2067?
To fix CVE-2013-2067, upgrade your Apache Tomcat to a version that is not affected, specifically versions above the vulnerable ones.
What versions of Apache Tomcat are affected by CVE-2013-2067?
CVE-2013-2067 affects Apache Tomcat versions 6.0.21 to 6.0.36 and 7.0.0 to 7.0.32.
What type of vulnerability is CVE-2013-2067?
CVE-2013-2067 is a session fixation vulnerability that can allow an attacker to hijack a session.
Can CVE-2013-2067 be exploited remotely?
Yes, CVE-2013-2067 can be exploited remotely under certain circumstances if the authentication request is manipulated.