org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting wh

Summary

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.

Timeline

1. Feb 26, 2014, 11:00 AM UTCCVE published
2. Aug 6, 2024, 8:58 AM UTCRecord last updated

Affected versions

• n/a n/a

  Version range not reported

• org.apache.tomcat:tomcatMaven

  From 6.0.33 · fixed in 6.0.38

References 23