The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token.
Fix
Patch, vendor advisory and mitigation references on NVD 6
- http://tomcat.apache.org/security-7.html Vendor Advisory
- http://tomcat.apache.org/security-8.html Vendor Advisory
- http://tomcat.apache.org/security-9.html Vendor Advisory
- http://tomcat.apache.org/security-7.html Vendor Advisory
- http://tomcat.apache.org/security-8.html Vendor Advisory
- http://tomcat.apache.org/security-9.html Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.8 · apache, debian, canonicalNVD modified 2026-10-14 22:17
Affected (CPE criteria) 74
cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.5:beta:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.53:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.54:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.55:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.56:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.57:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.59:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:7.0.61:*:*:*:*:*:*:*- and 34 more
References 72
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html
- http://packetstormsecurity.com/files/135882/Apache-Tomcat-CSRF-Token-Leak.html
- http://rhn.redhat.com/errata/RHSA-2016-1089.html
- http://rhn.redhat.com/errata/RHSA-2016-2599.html
- http://rhn.redhat.com/errata/RHSA-2016-2807.html
- http://rhn.redhat.com/errata/RHSA-2016-2808.html
- http://seclists.org/bugtraq/2016/Feb/148
- http://svn.apache.org/viewvc?view=revision&revision=1720652
- http://svn.apache.org/viewvc?view=revision&revision=1720655
- http://svn.apache.org/viewvc?view=revision&revision=1720658
- http://svn.apache.org/viewvc?view=revision&revision=1720660
- http://svn.apache.org/viewvc?view=revision&revision=1720661
- http://svn.apache.org/viewvc?view=revision&revision=1720663
- http://tomcat.apache.org/security-7.html Vendor Advisory
- http://tomcat.apache.org/security-8.html Vendor Advisory
- http://tomcat.apache.org/security-9.html Vendor Advisory
- http://www.debian.org/security/2016/dsa-3530
- http://www.debian.org/security/2016/dsa-3552
- http://www.debian.org/security/2016/dsa-3609
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.securityfocus.com/bid/83330
- http://www.securitytracker.com/id/1035069
- http://www.ubuntu.com/usn/USN-3024-1
- https://access.redhat.com/errata/RHSA-2016:1087
- https://access.redhat.com/errata/RHSA-2016:1088
- https://bto.bluecoat.com/security-advisory/sa118
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
- https://security.gentoo.org/glsa/201705-09
- https://security.netapp.com/advisory/ntap-20180531-0001/
- https://softwaresupport.hpe.com/document/-/facetsearch/document/KM02978021
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html
- http://packetstormsecurity.com/files/135882/Apache-Tomcat-CSRF-Token-Leak.html
- http://rhn.redhat.com/errata/RHSA-2016-1089.html
- http://rhn.redhat.com/errata/RHSA-2016-2599.html
- http://rhn.redhat.com/errata/RHSA-2016-2807.html
- http://rhn.redhat.com/errata/RHSA-2016-2808.html
- http://seclists.org/bugtraq/2016/Feb/148
- http://svn.apache.org/viewvc?view=revision&revision=1720652
- http://svn.apache.org/viewvc?view=revision&revision=1720655
- http://svn.apache.org/viewvc?view=revision&revision=1720658
- http://svn.apache.org/viewvc?view=revision&revision=1720660
- http://svn.apache.org/viewvc?view=revision&revision=1720661
- http://svn.apache.org/viewvc?view=revision&revision=1720663
- http://tomcat.apache.org/security-7.html Vendor Advisory
- http://tomcat.apache.org/security-8.html Vendor Advisory
- http://tomcat.apache.org/security-9.html Vendor Advisory
- http://www.debian.org/security/2016/dsa-3530
- http://www.debian.org/security/2016/dsa-3552
- http://www.debian.org/security/2016/dsa-3609
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html