CVE-2015-5346

Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments…

Published Feb 25, 2016 · updated Oct 14, 2026 · n/a n/a

Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

Feb 25, 2016 · NIST NVD
Detected
Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.
Oct 14, 2026 · NIST NVD
Updated
Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.

Affected

cpe apache/tomcat7.0.0
cpe apache/tomcat7.0.10
cpe apache/tomcat7.0.11
cpe apache/tomcat7.0.12
cpe apache/tomcat7.0.2
cpe apache/tomcat7.0.4
cpe apache/tomcat7.0.5
cpe apache/tomcat7.0.6
cpe canonical/ubuntu linux12.04
cpe debian/debian linux7.0
vendor n/a n/aversion unspecified

Sources

CIRCL Vulnerability LookupVulnerability recordCVE-2015-5346
Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leverag
vulnerability.circl.lu
CVE.orgVulnerability recordCVE-2015-5346
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2015-5346
30-day exploitation probability 10.6%
first.org
NIST NVDVulnerability recordCVE-2015-5346
Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leverag
nvd.nist.gov
Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/135890/Apache-Tomcat-Session-Fixation.html
Packet Storm link already published on the finding.
packetstormsecurity.com