Description
Apache Tomcat default installation contains the "/examples" directory which has many example servlets and JSPs.
Some of these examples are a security risk and should not be deployed on a production server.
The Sessions Example servlet (installed at /examples/servlets/servlet/SessionExample) allows session manipulation. Because the session is global this servlet poses a big security risk as an attacker can potentitally become an administrator by manipulating its session.
Remediation
Disable public access to the examples directory.
References
Related Vulnerabilities
Oracle Database Server CVE-2006-3705 Vulnerability (CVE-2006-3705)
Kentico Staging API publicly accessible
Joomla Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2020-15698)
Joomla Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-3056)
Liferay Portal Insecure Default Initialization of Resource Vulnerability (CVE-2023-33949)