CVE-2019-17563: tomcat from 7.0.0 (inclusive), through 7.0.98 (inclusive), from 8.5.0 (inclusive), through 8.5.49 (inclusive), from…

Affected technology

tomcat · from 7.0.0 (inclusive), through 7.0.98 (inclusive)
apache

tomcat · from 8.5.0 (inclusive), through 8.5.49 (inclusive)
apache

tomcat · from 9.0.0 (inclusive), through 9.0.29 (inclusive)
apache

debian linux · 8.0
debian

debian linux · 9.0
debian

debian linux · 10.0
debian

leap · 15.1
opensuse

ubuntu linux · 16.04
canonical

agile engineering data management · 6.2.1.0
oracle

hyperion infrastructure technology · 11.1.2.4
oracle

instantis enterprisetrack · from 17.1 (inclusive), through 17.3 (inclusive)
oracle

micros relate crm software · 11.4
oracle

mysql enterprise monitor · through 4.0.11.5331 (inclusive)
oracle

mysql enterprise monitor · from 8.0.0 (inclusive), through 8.0.18.1217 (inclusive)
oracle

retail order broker · 15.0
oracle

transportation management · 6.3.7
oracle

Apache Tomcat · 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49, 7.0.0 to 7.0.98
Apache Software Foundation

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

The source says when using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. NVD’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality, integrity and availability impact as high.