CVE-2013-6357: CSRF

Q: What is the severity of CVE-2013-6357?

CVE-2013-6357 is considered a medium severity vulnerability due to its potential to enable attackers to hijack administrator authentication.

Q: How do I fix CVE-2013-6357?

To fix CVE-2013-6357, upgrade Apache Tomcat to version 5.5.26 or later, where this vulnerability is addressed.

Q: Which versions of Apache Tomcat are affected by CVE-2013-6357?

CVE-2013-6357 affects Apache Tomcat versions up to 5.5.25, as well as several earlier versions.

Q: What type of vulnerability is CVE-2013-6357?

CVE-2013-6357 is a Cross-Site Request Forgery (CSRF) vulnerability.

Q: Can CVE-2013-6357 impact application deployment?

Yes, CVE-2013-6357 can allow attackers to manipulate application deployment by hijacking administrator sessions.

Published Nov 13, 2013

Updated

DISPUTED Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI. NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator."

Affected Software

93 affected components

Apache Tomcat<=5.5.25

Apache Tomcat=1.1.3

Apache Tomcat=3.0

Apache Tomcat=3.1

Apache Tomcat=3.1.1

Apache Tomcat=3.2

Apache Tomcat=3.2.1

Apache Tomcat=3.2.2

Apache Tomcat=3.2.2-beta2

Apache Tomcat=3.2.3

Apache Tomcat=3.2.4

Apache Tomcat=3.3

Apache Tomcat=3.3.1

Apache Tomcat=3.3.1a

Apache Tomcat=3.3.2

Apache Tomcat=4

Apache Tomcat=4.0.0

Apache Tomcat=4.0.1

Apache Tomcat=4.0.2

Apache Tomcat=4.0.3

Apache Tomcat=4.0.4

Apache Tomcat=4.0.5

Apache Tomcat=4.0.6

Apache Tomcat=4.1.0

Apache Tomcat=4.1.1

Apache Tomcat=4.1.2

Apache Tomcat=4.1.3

Apache Tomcat=4.1.3-beta

Apache Tomcat=4.1.9-beta

Apache Tomcat=4.1.10

Apache Tomcat=4.1.12

Apache Tomcat=4.1.15

Apache Tomcat=4.1.24

Apache Tomcat=4.1.28

Apache Tomcat=4.1.29

Apache Tomcat=4.1.31

Apache Tomcat=4.1.36

Apache Tomcat=5

Apache Tomcat=5.0.0

Apache Tomcat=5.0.1

Apache Tomcat=5.0.2

Apache Tomcat=5.0.3

Apache Tomcat=5.0.4

Apache Tomcat=5.0.5

Apache Tomcat=5.0.6

Apache Tomcat=5.0.7

Apache Tomcat=5.0.8

Apache Tomcat=5.0.9

Apache Tomcat=5.0.10

Apache Tomcat=5.0.11

Apache Tomcat=5.0.12

Apache Tomcat=5.0.13

Apache Tomcat=5.0.14

Apache Tomcat=5.0.15

Apache Tomcat=5.0.16

Apache Tomcat=5.0.17

Apache Tomcat=5.0.18

Apache Tomcat=5.0.19

Apache Tomcat=5.0.21

Apache Tomcat=5.0.22

Apache Tomcat=5.0.23

Apache Tomcat=5.0.24

Apache Tomcat=5.0.25

Apache Tomcat=5.0.26

Apache Tomcat=5.0.27

Apache Tomcat=5.0.28

Apache Tomcat=5.0.29

Apache Tomcat=5.0.30

Apache Tomcat=5.5.0

Apache Tomcat=5.5.1

Apache Tomcat=5.5.2

Apache Tomcat=5.5.3

Apache Tomcat=5.5.4

Apache Tomcat=5.5.5

Apache Tomcat=5.5.6

Apache Tomcat=5.5.7

Apache Tomcat=5.5.8

Apache Tomcat=5.5.9

Apache Tomcat=5.5.10

Apache Tomcat=5.5.11

Apache Tomcat=5.5.12

Apache Tomcat=5.5.13

Apache Tomcat=5.5.14

Apache Tomcat=5.5.15

Apache Tomcat=5.5.16

Apache Tomcat=5.5.17

Apache Tomcat=5.5.18

Apache Tomcat=5.5.19

Apache Tomcat=5.5.20

Apache Tomcat=5.5.21

Apache Tomcat=5.5.22

Apache Tomcat=5.5.23

Apache Tomcat=5.5.24

Event History

Nov 13, 2013

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Disputed

03:55 PM

Data Sourced

via NVD·03:55 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2013-6357?

CVE-2013-6357 is considered a medium severity vulnerability due to its potential to enable attackers to hijack administrator authentication.

How do I fix CVE-2013-6357?

To fix CVE-2013-6357, upgrade Apache Tomcat to version 5.5.26 or later, where this vulnerability is addressed.

Which versions of Apache Tomcat are affected by CVE-2013-6357?