ByteOS Network

CVE Vulnerability Details :

CVE-2015-5351

PUBLISHED

More Info Official Page

Assigner-redhat

Assigner Org ID-53f830b8-0a3f-465b-8143-3b8a9948e749

Published At-25 Feb, 2016 | 01:00

Updated At-06 Aug, 2024 | 06:41

▼CVE Numbering Authority (CNA)

The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token.

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
http://www.securityfocus.com/bid/83330	vdb-entry x_refsource_BID
http://packetstormsecurity.com/files/135882/Apache-Tomcat-CSRF-Token-Leak.html	x_refsource_MISC
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html	x_refsource_CONFIRM
https://security.gentoo.org/glsa/201705-09	vendor-advisory x_refsource_GENTOO
http://svn.apache.org/viewvc?view=revision&revision=1720658	x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html	vendor-advisory x_refsource_SUSE
http://tomcat.apache.org/security-9.html	x_refsource_CONFIRM
http://www.ubuntu.com/usn/USN-3024-1	vendor-advisory x_refsource_UBUNTU
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html	vendor-advisory x_refsource_SUSE
http://www.debian.org/security/2016/dsa-3530	vendor-advisory x_refsource_DEBIAN
http://tomcat.apache.org/security-7.html	x_refsource_CONFIRM
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html	x_refsource_CONFIRM
http://seclists.org/bugtraq/2016/Feb/148	mailing-list x_refsource_BUGTRAQ
http://rhn.redhat.com/errata/RHSA-2016-1089.html	vendor-advisory x_refsource_REDHAT
http://tomcat.apache.org/security-8.html	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2016:1087	vendor-advisory x_refsource_REDHAT
http://svn.apache.org/viewvc?view=revision&revision=1720655	x_refsource_CONFIRM
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	x_refsource_CONFIRM
http://www.securitytracker.com/id/1035069	vdb-entry x_refsource_SECTRACK
https://bto.bluecoat.com/security-advisory/sa118	x_refsource_CONFIRM
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442	x_refsource_CONFIRM
http://svn.apache.org/viewvc?view=revision&revision=1720663	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2016-2807.html	vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2016:1088	vendor-advisory x_refsource_REDHAT
https://security.netapp.com/advisory/ntap-20180531-0001/	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2016-2808.html	vendor-advisory x_refsource_REDHAT
http://svn.apache.org/viewvc?view=revision&revision=1720661	x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html	vendor-advisory x_refsource_SUSE
http://rhn.redhat.com/errata/RHSA-2016-2599.html	vendor-advisory x_refsource_REDHAT
http://www.debian.org/security/2016/dsa-3609	vendor-advisory x_refsource_DEBIAN
http://svn.apache.org/viewvc?view=revision&revision=1720652	x_refsource_CONFIRM
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626	x_refsource_CONFIRM
https://softwaresupport.hpe.com/document/-/facetsearch/document/KM02978021	x_refsource_CONFIRM
http://www.debian.org/security/2016/dsa-3552	vendor-advisory x_refsource_DEBIAN
http://svn.apache.org/viewvc?view=revision&revision=1720660	x_refsource_CONFIRM
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E	mailing-list x_refsource_MLIST

Hyperlink: http://www.securityfocus.com/bid/83330

Resource:

vdb-entry

x_refsource_BID

Hyperlink: http://packetstormsecurity.com/files/135882/Apache-Tomcat-CSRF-Token-Leak.html

Resource:

x_refsource_MISC

Hyperlink: http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Resource:

x_refsource_CONFIRM

Hyperlink: https://security.gentoo.org/glsa/201705-09

Resource:

vendor-advisory

x_refsource_GENTOO

Hyperlink: http://svn.apache.org/viewvc?view=revision&revision=1720658

Resource:

x_refsource_CONFIRM

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html

Resource:

vendor-advisory

x_refsource_SUSE

Hyperlink: http://tomcat.apache.org/security-9.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.ubuntu.com/usn/USN-3024-1

Resource:

vendor-advisory

x_refsource_UBUNTU

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html

Resource:

vendor-advisory

x_refsource_SUSE

Hyperlink: http://www.debian.org/security/2016/dsa-3530

Resource:

vendor-advisory

x_refsource_DEBIAN

Hyperlink: http://tomcat.apache.org/security-7.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://seclists.org/bugtraq/2016/Feb/148

Resource:

mailing-list

x_refsource_BUGTRAQ

Hyperlink: http://rhn.redhat.com/errata/RHSA-2016-1089.html

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: http://tomcat.apache.org/security-8.html

Resource:

x_refsource_CONFIRM

Hyperlink: https://access.redhat.com/errata/RHSA-2016:1087

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: http://svn.apache.org/viewvc?view=revision&revision=1720655

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.securitytracker.com/id/1035069

Resource:

vdb-entry

x_refsource_SECTRACK

Hyperlink: https://bto.bluecoat.com/security-advisory/sa118

Resource:

x_refsource_CONFIRM

Hyperlink: https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442

Resource:

x_refsource_CONFIRM

Hyperlink: http://svn.apache.org/viewvc?view=revision&revision=1720663

Resource:

x_refsource_CONFIRM

Hyperlink: http://rhn.redhat.com/errata/RHSA-2016-2807.html

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://access.redhat.com/errata/RHSA-2016:1088

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://security.netapp.com/advisory/ntap-20180531-0001/

Resource:

x_refsource_CONFIRM

Hyperlink: http://rhn.redhat.com/errata/RHSA-2016-2808.html

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: http://svn.apache.org/viewvc?view=revision&revision=1720661

Resource:

x_refsource_CONFIRM

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html

Resource:

vendor-advisory

x_refsource_SUSE

Hyperlink: http://rhn.redhat.com/errata/RHSA-2016-2599.html

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: http://www.debian.org/security/2016/dsa-3609

Resource:

vendor-advisory

x_refsource_DEBIAN

Hyperlink: http://svn.apache.org/viewvc?view=revision&revision=1720652

Resource:

x_refsource_CONFIRM

Hyperlink: https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626

Resource:

x_refsource_CONFIRM

Hyperlink: https://softwaresupport.hpe.com/document/-/facetsearch/document/KM02978021

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.debian.org/security/2016/dsa-3552

Resource:

vendor-advisory

x_refsource_DEBIAN

Hyperlink: http://svn.apache.org/viewvc?view=revision&revision=1720660

Resource:

x_refsource_CONFIRM

Hyperlink: https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E

Resource:

mailing-list

x_refsource_MLIST

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://www.securityfocus.com/bid/83330	vdb-entry x_refsource_BID x_transferred
http://packetstormsecurity.com/files/135882/Apache-Tomcat-CSRF-Token-Leak.html	x_refsource_MISC x_transferred
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html	x_refsource_CONFIRM x_transferred
https://security.gentoo.org/glsa/201705-09	vendor-advisory x_refsource_GENTOO x_transferred
http://svn.apache.org/viewvc?view=revision&revision=1720658	x_refsource_CONFIRM x_transferred
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html	vendor-advisory x_refsource_SUSE x_transferred
http://tomcat.apache.org/security-9.html	x_refsource_CONFIRM x_transferred
http://www.ubuntu.com/usn/USN-3024-1	vendor-advisory x_refsource_UBUNTU x_transferred
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html	vendor-advisory x_refsource_SUSE x_transferred
http://www.debian.org/security/2016/dsa-3530	vendor-advisory x_refsource_DEBIAN x_transferred
http://tomcat.apache.org/security-7.html	x_refsource_CONFIRM x_transferred
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html	x_refsource_CONFIRM x_transferred
http://seclists.org/bugtraq/2016/Feb/148	mailing-list x_refsource_BUGTRAQ x_transferred
http://rhn.redhat.com/errata/RHSA-2016-1089.html	vendor-advisory x_refsource_REDHAT x_transferred
http://tomcat.apache.org/security-8.html	x_refsource_CONFIRM x_transferred
https://access.redhat.com/errata/RHSA-2016:1087	vendor-advisory x_refsource_REDHAT x_transferred
http://svn.apache.org/viewvc?view=revision&revision=1720655	x_refsource_CONFIRM x_transferred
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	x_refsource_CONFIRM x_transferred
http://www.securitytracker.com/id/1035069	vdb-entry x_refsource_SECTRACK x_transferred
https://bto.bluecoat.com/security-advisory/sa118	x_refsource_CONFIRM x_transferred
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442	x_refsource_CONFIRM x_transferred
http://svn.apache.org/viewvc?view=revision&revision=1720663	x_refsource_CONFIRM x_transferred
http://rhn.redhat.com/errata/RHSA-2016-2807.html	vendor-advisory x_refsource_REDHAT x_transferred
https://access.redhat.com/errata/RHSA-2016:1088	vendor-advisory x_refsource_REDHAT x_transferred
https://security.netapp.com/advisory/ntap-20180531-0001/	x_refsource_CONFIRM x_transferred
http://rhn.redhat.com/errata/RHSA-2016-2808.html	vendor-advisory x_refsource_REDHAT x_transferred
http://svn.apache.org/viewvc?view=revision&revision=1720661	x_refsource_CONFIRM x_transferred
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html	vendor-advisory x_refsource_SUSE x_transferred
http://rhn.redhat.com/errata/RHSA-2016-2599.html	vendor-advisory x_refsource_REDHAT x_transferred
http://www.debian.org/security/2016/dsa-3609	vendor-advisory x_refsource_DEBIAN x_transferred
http://svn.apache.org/viewvc?view=revision&revision=1720652	x_refsource_CONFIRM x_transferred
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626	x_refsource_CONFIRM x_transferred
https://softwaresupport.hpe.com/document/-/facetsearch/document/KM02978021	x_refsource_CONFIRM x_transferred
http://www.debian.org/security/2016/dsa-3552	vendor-advisory x_refsource_DEBIAN x_transferred
http://svn.apache.org/viewvc?view=revision&revision=1720660	x_refsource_CONFIRM x_transferred
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E	mailing-list x_refsource_MLIST x_transferred