Description

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.

Remediation

References

CVE-2014-0033

Related Vulnerabilities

WordPress Plugin Stop Spammers Security-Block Spam Users, Comments, Forms Cross-Site Scripting (2021.17)

Perl Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-1487)

Plone arbitrary code execution

Drupal Core 6.x Multiple Security Bypass Vulnerabilities (6.0 - 6.4)

MongoDb Excessive Iteration Vulnerability (CVE-2018-20805)

Severity

Medium

Classification

CVE-2014-0033 CWE-20

Tags

Missing Update Known Vulnerabilities