CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2013-2067

java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a session fixation attack.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.042

EPSS Ranking 88.3%

CVSS Severity

CVSS v2 Score 6.8

References

Products affected by CVE-2013-2067

Apache » Tomcat » Version: 6.0.21

cpe:2.3:a:apache:tomcat:6.0.21
Apache » Tomcat » Version: 6.0.24

cpe:2.3:a:apache:tomcat:6.0.24
Apache » Tomcat » Version: 6.0.26

cpe:2.3:a:apache:tomcat:6.0.26
Apache » Tomcat » Version: 6.0.27

cpe:2.3:a:apache:tomcat:6.0.27
Apache » Tomcat » Version: 6.0.28

cpe:2.3:a:apache:tomcat:6.0.28
Apache » Tomcat » Version: 6.0.29

cpe:2.3:a:apache:tomcat:6.0.29
Apache » Tomcat » Version: 6.0.30

cpe:2.3:a:apache:tomcat:6.0.30
Apache » Tomcat » Version: 6.0.31

cpe:2.3:a:apache:tomcat:6.0.31
Apache » Tomcat » Version: 6.0.32

cpe:2.3:a:apache:tomcat:6.0.32
Apache » Tomcat » Version: 6.0.33

cpe:2.3:a:apache:tomcat:6.0.33
Apache » Tomcat » Version: 6.0.35

cpe:2.3:a:apache:tomcat:6.0.35
Apache » Tomcat » Version: 6.0.36

cpe:2.3:a:apache:tomcat:6.0.36
Apache » Tomcat » Version: 7.0.0

cpe:2.3:a:apache:tomcat:7.0.0
Apache » Tomcat » Version: 7.0.1

cpe:2.3:a:apache:tomcat:7.0.1
Apache » Tomcat » Version: 7.0.10

cpe:2.3:a:apache:tomcat:7.0.10
Apache » Tomcat » Version: 7.0.11

cpe:2.3:a:apache:tomcat:7.0.11
Apache » Tomcat » Version: 7.0.12

cpe:2.3:a:apache:tomcat:7.0.12
Apache » Tomcat » Version: 7.0.13

cpe:2.3:a:apache:tomcat:7.0.13
Apache » Tomcat » Version: 7.0.14

cpe:2.3:a:apache:tomcat:7.0.14
Apache » Tomcat » Version: 7.0.15

cpe:2.3:a:apache:tomcat:7.0.15
Apache » Tomcat » Version: 7.0.16

cpe:2.3:a:apache:tomcat:7.0.16
Apache » Tomcat » Version: 7.0.17

cpe:2.3:a:apache:tomcat:7.0.17
Apache » Tomcat » Version: 7.0.18

cpe:2.3:a:apache:tomcat:7.0.18
Apache » Tomcat » Version: 7.0.19

cpe:2.3:a:apache:tomcat:7.0.19
Apache » Tomcat » Version: 7.0.2

cpe:2.3:a:apache:tomcat:7.0.2
Apache » Tomcat » Version: 7.0.20

cpe:2.3:a:apache:tomcat:7.0.20
Apache » Tomcat » Version: 7.0.21

cpe:2.3:a:apache:tomcat:7.0.21
Apache » Tomcat » Version: 7.0.22

cpe:2.3:a:apache:tomcat:7.0.22
Apache » Tomcat » Version: 7.0.23

cpe:2.3:a:apache:tomcat:7.0.23
Apache » Tomcat » Version: 7.0.25

cpe:2.3:a:apache:tomcat:7.0.25
Apache » Tomcat » Version: 7.0.28

cpe:2.3:a:apache:tomcat:7.0.28
Apache » Tomcat » Version: 7.0.3

cpe:2.3:a:apache:tomcat:7.0.3
Apache » Tomcat » Version: 7.0.30

cpe:2.3:a:apache:tomcat:7.0.30
Apache » Tomcat » Version: 7.0.32

cpe:2.3:a:apache:tomcat:7.0.32
Apache » Tomcat » Version: 7.0.4

cpe:2.3:a:apache:tomcat:7.0.4
Apache » Tomcat » Version: 7.0.5

cpe:2.3:a:apache:tomcat:7.0.5
Apache » Tomcat » Version: 7.0.6

cpe:2.3:a:apache:tomcat:7.0.6
Apache » Tomcat » Version: 7.0.7

cpe:2.3:a:apache:tomcat:7.0.7
Apache » Tomcat » Version: 7.0.8

cpe:2.3:a:apache:tomcat:7.0.8
Apache » Tomcat » Version: 7.0.9

cpe:2.3:a:apache:tomcat:7.0.9

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2013-2067

Products

Pricing

Contact Us