ZeroDay Findings
Sign inSign up

Findings

CVE-2015-5351

The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF token…

Published Feb 25, 2016 · updated Oct 14, 2026 · n/a n/a

The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 25, 2016 · NIST NVD

    Detected

    The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token.

  2. Oct 14, 2026 · NIST NVD

    Updated

    The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token.

Affected

  • cpe apache/tomcat7.0.0
  • cpe apache/tomcat7.0.10
  • cpe apache/tomcat7.0.11
  • cpe apache/tomcat7.0.12
  • cpe apache/tomcat7.0.2
  • cpe apache/tomcat7.0.4
  • cpe apache/tomcat7.0.5
  • cpe apache/tomcat7.0.6
  • cpe canonical/ubuntu linux12.04
  • cpe debian/debian linux7.0
  • vendor n/a n/aversion unspecified

Sources

  • CIRCL Vulnerability LookupCVE-2015-5351

    The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a toke

    vulnerability.circl.lu
  • CVE.orgCVE-2015-5351

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2015-5351

    30-day exploitation probability 9.7%

    first.org
  • NIST NVDCVE-2015-5351

    The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a toke

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/135882/Apache-Tomcat-CSRF-Token-Leak.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References