Description

Important: Bypass of CSRF prevention filter CVE-2012-4431

The CSRF prevention filter could be bypassed if a request was made to a protected resource without a session identifier present in the request.

Affected Apache Tomcat versions (7.0.0 - 7.0.31).

Remediation

Upgrade to the latest version of Apache Tomcat.

References

CVE-2012-4431

Apache Tomcat 7.x vulnerabilities

Related Vulnerabilities

osCommerce Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-43728)

CKEditor Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-41164)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-27914)

WordPress Plugin Watu Quiz Cross-Site Scripting (3.3.9.2)

Joomla! Core PHP Object Injection (2.5.4 - 3.8.12)

Severity

Medium

Classification

CVE-2012-4431 CWE-264 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Configuration CSRF Missing Update