CVE-2013-2067 — MEDIUM (6.8)

Vulnerability Description

java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a session fixation attack.

CVSS Score

6.8

MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:P

Confidentiality

PARTIAL

Integrity

PARTIAL

Availability

PARTIAL

Affected Products

Vendor	Product	Versions
Apache	Tomcat	6.0.21

Related Weaknesses (CWE)

CWE-287

References

FAQ

What is CVE-2013-2067?

CVE-2013-2067 is a vulnerability with a CVSS score of 6.8 (MEDIUM). java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships...

How severe is CVE-2013-2067?

CVE-2013-2067 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2013-2067?

Check the references section above for vendor advisories and patch information. Affected products include: Apache Tomcat.