Home > Vulnerability Database > CVE-2013-2067

Mend.io Vulnerability Database

CVE-2013-2067

Good to know:

Date: June 1, 2013

java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a session fixation attack.

Language: Java

Severity Score

5.6

Related Resources (27)

Url: http://rhn.redhat.com/errata/RHSA-2013-0964.html

Url: http://svn.apache.org/viewvc?view=revision&revision=1408044

Url: http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/authenticator/FormAuthenticator.java?r1=1408044&r2=1408043&pathrev=1408044

Url: http://www.ubuntu.com/usn/USN-1841-1

Url: http://rhn.redhat.com/errata/RHSA-2013-0839.html

Url: http://rhn.redhat.com/errata/RHSA-2013-1437.html

Url: http://rhn.redhat.com/errata/RHSA-2013-0834.html

Url: http://www.securityfocus.com/bid/64758

Url: http://svn.apache.org/viewvc?view=revision&revision=1417891

Url: http://rhn.redhat.com/errata/RHSA-2013-0833.html

Url: https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2013-2067

Url: https://nvd.nist.gov/vuln/detail/CVE-2013-2067

Url: http://tomcat.apache.org/security-7.html

Url: http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Url: https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E

Url: https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E

Url: https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E

Url: https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E

Url: https://access.redhat.com/security/cve/CVE-2013-2067

Url: http://archives.neohapsis.com/archives/bugtraq/2013-05/0041.html

Url: https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E

Url: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html

Url: http://www.securityfocus.com/bid/59799

Url: http://tomcat.apache.org/security-6.html

Url: http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/java/org/apache/catalina/authenticator/FormAuthenticator.java?r1=1417891&r2=1417890&pathrev=1417891

Url: https://www.mend.io/vulnerability-database/CVE-2013-2067

Severity Score

5.6

Weakness Type (CWE)

Authentication Issues

CWE-287

Top Fix

Upgrade Version

Upgrade to version 7.0.33

Learn More

CVSS v3.1

Base Score:	5.6
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	LOW

CVSS v2

Base Score:	6.8
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2013-2067

Good to know:

Date: June 1, 2013

Language: Java

Severity Score

Related Resources (27)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

CVSS v2

Do you need more information?