When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Tomcat | Apache | 7.0.0 (including) | 7.0.98 (including) |
| Tomcat | Apache | 8.5.0 (including) | 8.5.49 (including) |
| Tomcat | Apache | 9.0.0 (including) | 9.0.29 (including) |
| Red Hat Enterprise Linux 7 | RedHat | tomcat-0:7.0.76-15.el7 | * |
| Red Hat Enterprise Linux 7.6 Extended Update Support | RedHat | tomcat-0:7.0.76-11.el7_6 | * |
| Red Hat Enterprise Linux 7.7 Extended Update Support | RedHat | tomcat-0:7.0.76-12.el7_7 | * |
| Red Hat JBoss Web Server 3.1 | RedHat | tomcat | * |
| Red Hat JBoss Web Server 3 for RHEL 6 | RedHat | tomcat7-0:7.0.70-38.ep7.el6 | * |
| Red Hat JBoss Web Server 3 for RHEL 6 | RedHat | tomcat8-0:8.0.36-42.ep7.el6 | * |
| Red Hat JBoss Web Server 3 for RHEL 6 | RedHat | tomcat-native-0:1.2.23-21.redhat_21.ep7.el6 | * |
| Red Hat JBoss Web Server 3 for RHEL 7 | RedHat | tomcat7-0:7.0.70-38.ep7.el7 | * |
| Red Hat JBoss Web Server 3 for RHEL 7 | RedHat | tomcat8-0:8.0.36-42.ep7.el7 | * |
| Red Hat JBoss Web Server 3 for RHEL 7 | RedHat | tomcat-native-0:1.2.23-21.redhat_21.ep7.el7 | * |
| Red Hat JBoss Web Server 5.3 on RHEL 6 | RedHat | jws5-tomcat-0:9.0.30-3.redhat_4.1.el6jws | * |
| Red Hat JBoss Web Server 5.3 on RHEL 6 | RedHat | jws5-tomcat-native-0:1.2.23-4.redhat_4.el6jws | * |
| Red Hat JBoss Web Server 5.3 on RHEL 7 | RedHat | jws5-tomcat-0:9.0.30-3.redhat_4.1.el7jws | * |
| Red Hat JBoss Web Server 5.3 on RHEL 7 | RedHat | jws5-tomcat-native-0:1.2.23-4.redhat_4.el7jws | * |
| Red Hat JBoss Web Server 5.3 on RHEL 8 | RedHat | jws5-tomcat-0:9.0.30-3.redhat_4.1.el8jws | * |
| Red Hat JBoss Web Server 5.3 on RHEL 8 | RedHat | jws5-tomcat-native-0:1.2.23-4.redhat_4.el8jws | * |
| Red Hat JBoss Web Server (JWS) 5.3 | RedHat | tomcat | * |
| Tomcat7 | Ubuntu | bionic | * |
| Tomcat7 | Ubuntu | trusty | * |
| Tomcat7 | Ubuntu | trusty/esm | * |
| Tomcat7 | Ubuntu | xenial | * |
| Tomcat8 | Ubuntu | bionic | * |
| Tomcat8 | Ubuntu | trusty | * |
| Tomcat8 | Ubuntu | xenial | * |
| Tomcat9 | Ubuntu | bionic | * |
| Tomcat9 | Ubuntu | disco | * |
| Tomcat9 | Ubuntu | eoan | * |
| Tomcat9 | Ubuntu | trusty | * |
Such a scenario is commonly observed when: