Session fixation in Apache Tomcat
Priority MEDIUM 48CWE-384Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 25 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-384.
Summary
When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.10687 95th percentileScored 2026-11-07
Fix Partial org.apache.tomcat.embed:tomcat-embed-core (Maven): 7.0.99, 8.5.50, 9.0.30Red Hat: 7 advisoriesRed Hat: 25 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Tomcat | 9.0.0.M1 to 9.0.29; 8.5.0 to 8.5.49; 7.0.0 to 7.0.98 | — | No fix listed | CNA |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | before 7.0.99 | 7.0.99 | Patch available | GHSA-9xcj-c8cr-8c3c |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 8.0.0 to before 8.5.50 | 8.5.50 | Patch available | GHSA-9xcj-c8cr-8c3c |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 9.0.0 to before 9.0.30 | 9.0.30 | Patch available | GHSA-9xcj-c8cr-8c3c |
- Apache Tomcat VendorApache Affected 9.0.0.M1 to 9.0.29; 8.5.0 to 8.5.49; 7.0.0 to 7.0.98 Fixed in — No fix listed CNA
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected before 7.0.99 Fixed in 7.0.99 Patch available GHSA-9xcj-c8cr-8c3c
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 8.0.0 to before 8.5.50 Fixed in 8.5.50 Patch available GHSA-9xcj-c8cr-8c3c
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 9.0.0 to before 9.0.30 Fixed in 9.0.30 Patch available GHSA-9xcj-c8cr-8c3c
CPE configurations NVD · 13
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | 7.0.0 – 7.0.98; 8.5.0 – 8.5.49; 9.0.0 – 9.0.29 | Vulnerable | Apache |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:* | 6.2.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:*:*:*:*:*:*:* | 11.1.2.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:instantis_enterprisetrack:*:*:*:*:*:*:*:* | 17.1 – 17.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:micros_relate_crm_software:11.4:*:*:*:*:*:*:* | 11.4 | Vulnerable | Oracle |
- cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 7.0.0 – 7.0.98; 8.5.0 – 8.5.49; 9.0.0 – 9.0.29 Vulnerable ·Apache
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:* Versions 6.2.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:*:*:*:*:*:*:* Versions 11.1.2.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:instantis_enterprisetrack:*:*:*:*:*:*:*:* Versions 17.1 – 17.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:micros_relate_crm_software:11.4:*:*:*:*:*:*:* Versions 11.4 Vulnerable ·Oracle
Show 3 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* | up to 4.0.11.5331; 8.0.0 – 8.0.18.1217 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:transportation_management:6.3.7:*:*:*:*:*:*:* | 6.3.7 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* Versions up to 4.0.11.5331; 8.0.0 – 8.0.18.1217 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:transportation_management:6.3.7:*:*:*:*:*:*:* Versions 6.3.7 Vulnerable ·Oracle
Remediation
- Fix · GHSA-9xcj-c8cr-8c3c org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 7.0.99 Advisory →
- Fix · GHSA-9xcj-c8cr-8c3c org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 8.5.50 Advisory →
- Fix · GHSA-9xcj-c8cr-8c3c org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 9.0.30 Advisory →
Red Hat 7 advisories
- RHSA-2021:1030 Released 2021-03-30 · Red Hat rating Lowtomcat security update
- Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) tomcat-7.0.76-12.el7_7, tomcat-servlet-3.0-api-7.0.76-12.el7_7
- Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) tomcat-7.0.76-12.el7_7, tomcat-admin-webapps-7.0.76-12.el7_7, tomcat-docs-webapp-7.0.76-12.el7_7 +6
- Red Hat Enterprise Linux Server EUS (v. 7.7) tomcat-7.0.76-12.el7_7, tomcat-admin-webapps-7.0.76-12.el7_7, tomcat-el-2.2-api-7.0.76-12.el7_7 +4
- Red Hat Enterprise Linux Server Optional EUS (v. 7.7) tomcat-7.0.76-12.el7_7, tomcat-admin-webapps-7.0.76-12.el7_7, tomcat-docs-webapp-7.0.76-12.el7_7 +6
- RHSA-2021:0882 Released 2021-03-16 · Red Hat rating Lowtomcat security update
- Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) tomcat-7.0.76-11.el7_6, tomcat-servlet-3.0-api-7.0.76-11.el7_6
- Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) tomcat-7.0.76-11.el7_6, tomcat-admin-webapps-7.0.76-11.el7_6, tomcat-docs-webapp-7.0.76-11.el7_6 +6
- Red Hat Enterprise Linux Server EUS (v. 7.6) tomcat-7.0.76-11.el7_6, tomcat-admin-webapps-7.0.76-11.el7_6, tomcat-el-2.2-api-7.0.76-11.el7_6 +4
- Red Hat Enterprise Linux Server Optional EUS (v. 7.6) tomcat-7.0.76-11.el7_6, tomcat-admin-webapps-7.0.76-11.el7_6, tomcat-docs-webapp-7.0.76-11.el7_6 +6
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) tomcat-7.0.76-11.el7_6, tomcat-admin-webapps-7.0.76-11.el7_6, tomcat-el-2.2-api-7.0.76-11.el7_6 +4
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) tomcat-7.0.76-11.el7_6, tomcat-admin-webapps-7.0.76-11.el7_6, tomcat-docs-webapp-7.0.76-11.el7_6 +6
- RHSA-2020:4004 Released 2020-09-29 · Red Hat rating Importanttomcat security and bug fix update
- Red Hat Enterprise Linux Client (v. 7) tomcat-7.0.76-15.el7, tomcat-servlet-3.0-api-7.0.76-15.el7
- Red Hat Enterprise Linux Client Optional (v. 7) tomcat-7.0.76-15.el7, tomcat-admin-webapps-7.0.76-15.el7, tomcat-docs-webapp-7.0.76-15.el7 +6
- Red Hat Enterprise Linux ComputeNode (v. 7) tomcat-7.0.76-15.el7, tomcat-servlet-3.0-api-7.0.76-15.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat-7.0.76-15.el7, tomcat-admin-webapps-7.0.76-15.el7, tomcat-docs-webapp-7.0.76-15.el7 +6
- Red Hat Enterprise Linux Server (v. 7) tomcat-7.0.76-15.el7, tomcat-admin-webapps-7.0.76-15.el7, tomcat-el-2.2-api-7.0.76-15.el7 +4
- Red Hat Enterprise Linux Server Optional (v. 7) tomcat-7.0.76-15.el7, tomcat-admin-webapps-7.0.76-15.el7, tomcat-docs-webapp-7.0.76-15.el7 +6
- Red Hat Enterprise Linux Workstation (v. 7) tomcat-7.0.76-15.el7, tomcat-admin-webapps-7.0.76-15.el7, tomcat-el-2.2-api-7.0.76-15.el7 +4
- Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-docs-webapp-7.0.76-15.el7, tomcat-javadoc-7.0.76-15.el7, tomcat-jsvc-7.0.76-15.el7
Show 4 more Red Hat advisories
- RHSA-2020:1520 Released 2020-04-21 · Red Hat rating ImportantRed Hat JBoss Web Server 5.3 release
- Red Hat JBoss Web Server 5.3 for RHEL 6 Server jws5-tomcat-9.0.30-3.redhat_4.1.el6jws, jws5-tomcat-admin-webapps-9.0.30-3.redhat_4.1.el6jws, jws5-tomcat-docs-webapp-9.0.30-3.redhat_4.1.el6jws +8
- Red Hat JBoss Web Server 5.3 for RHEL 7 Server jws5-tomcat-9.0.30-3.redhat_4.1.el7jws, jws5-tomcat-admin-webapps-9.0.30-3.redhat_4.1.el7jws, jws5-tomcat-docs-webapp-9.0.30-3.redhat_4.1.el7jws +8
- Red Hat JBoss Web Server 5.3 for RHEL 8 jws5-tomcat-9.0.30-3.redhat_4.1.el8jws, jws5-tomcat-admin-webapps-9.0.30-3.redhat_4.1.el8jws, jws5-tomcat-docs-webapp-9.0.30-3.redhat_4.1.el8jws +8
- RHSA-2020:1521 Released 2020-04-21 · Red Hat rating ImportantRed Hat JBoss Web Server 5.3 release
- Red Hat JBoss Web Server (JWS) 5.3
- RHSA-2020:0861 Released 2020-03-17 · Red Hat rating ImportantRed Hat JBoss Web Server 3.1 Service Pack 8 security update
- Red Hat JBoss Web Server 3.1 for RHEL 6 tomcat-native-1.2.23-21.redhat_21.ep7.el6, tomcat7-7.0.70-38.ep7.el6, tomcat7-admin-webapps-7.0.70-38.ep7.el6 +22
- Red Hat JBoss Web Server 3.1 for RHEL 7 tomcat-native-1.2.23-21.redhat_21.ep7.el7, tomcat7-7.0.70-38.ep7.el7, tomcat7-admin-webapps-7.0.70-38.ep7.el7 +22
- RHSA-2020:0860 Released 2020-03-17 · Red Hat rating ImportantRed Hat JBoss Web Server 3.1 Service Pack 8 security update
- Red Hat JBoss Web Server 3.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Apache Tomcat — USN-4251-1
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2019-09263 Insufficiently protected credentials in Apache TomcatPriority LOW 35
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss BRMS 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2020:4004 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2020:4004 |
| Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2020:4004 |
| Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) | Fixed | RHSA-2021:0882 |
| Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) | Fixed | RHSA-2021:1030 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2020:4004 |
| Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) | Fixed | RHSA-2021:0882 |
| Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) | Fixed | RHSA-2021:1030 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2020:4004 |
| Red Hat Enterprise Linux Server EUS (v. 7.6) | Fixed | RHSA-2021:0882 |
| Red Hat Enterprise Linux Server EUS (v. 7.7) | Fixed | RHSA-2021:1030 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2020:4004 |
| Red Hat Enterprise Linux Server Optional EUS (v. 7.6) | Fixed | RHSA-2021:0882 |
| Red Hat Enterprise Linux Server Optional EUS (v. 7.7) | Fixed | RHSA-2021:1030 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2020:4004 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2020:4004 |
| Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) | Fixed | RHSA-2021:0882 |
| Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) | Fixed | RHSA-2021:0882 |
| Red Hat JBoss Web Server (JWS) 5.3 | Fixed | RHSA-2020:1521 |
| Red Hat JBoss Web Server 3.1 | Fixed | RHSA-2020:0860 |
| Red Hat JBoss Web Server 3.1 for RHEL 6 | Fixed | RHSA-2020:0861 |
| Red Hat JBoss Web Server 3.1 for RHEL 7 | Fixed | RHSA-2020:0861 |
| Red Hat JBoss Web Server 5.3 for RHEL 6 Server | Fixed | RHSA-2020:1520 |
| Red Hat JBoss Web Server 5.3 for RHEL 7 Server | Fixed | RHSA-2020:1520 |
| Red Hat JBoss Web Server 5.3 for RHEL 8 | Fixed | RHSA-2020:1520 |
Not affected: 4 products
- Red Hat Fuse 7
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Fuse 6
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2019-17563
- 2026-10-03 Alias added: GHSA-9xcj-c8cr-8c3c
- 2026-10-08 CISA SSVC decision points changed
References
Patch 3
Advisory 11
- DSA-4596
- 20191229 [SECURITY] [DSA 4596-1] tomcat8 security update
- openSUSE-SU-2020:0038
- [debian-lts-announce] 20200127 [SECURITY] [DLA 2077-1] tomcat7 security update
- USN-4251-1
- GLSA-202003-43
- DSA-4680
- [debian-lts-announce] 20200528 [SECURITY] [DLA 2209-1] tomcat8 security update
- https://lists.apache.org/thread.html/8b4c1db8300117b28a0f3f743c0b9e3f964687a690cdf9662a884bbd%40%3Cannounce.tomcat.apache.org%3E
- https://security.netapp.com/advisory/ntap-20200107-0001/
- https://nvd.nist.gov/vuln/detail/CVE-2019-17563
Other 15
- [tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/
- [cxf-issues] 20200618 [jira] [Created] (FEDIZ-249) Relying party rejects a valid security token and redirects back to ADFS when using Fediz 1.4.6 with Tomcat 8.5.56
- https://usn.ubuntu.com/4251-1
- https://security.netapp.com/advisory/ntap-20200107-0001
- https://lists.apache.org/thread.html/reb9a66f176df29b9a832caa95ebd9ffa3284e8f4922ec4fa3ad8eb2e@%3Cissues.cxf.apache.org%3E
- https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
- https://github.com/apache/tomcat
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2019-17563 · CVE Program
- CVE-2019-17563 · NVD
- FIRST EPSS
- GHSA-9xcj-c8cr-8c3c · GitHub Advisory Database · CC BY 4.0
- CVE-2019-17563 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences