Vulnerability Database

313,825

Total vulnerabilities in the database

CVE-2014-0033

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.

CVSS v2:

  • Severity: Low
  • Score: 4.3
  • AV:N/AC:M/Au:N/C:P/I:N/A:N

CWEs:

Software From Fixed in
apache / tomcat 6.0.33 6.0.33.x
apache / tomcat 6.0.34 6.0.34.x
apache / tomcat 6.0.37 6.0.37.x
apache / tomcat 6.0.35 6.0.35.x
apache / tomcat 6.0.36 6.0.36.x
Maven icon org.apache.tomcat / tomcat 6.0.33 6.0.38