CoreCVE
Back

MEDIUM

tomcat: session fixation still possible with disableURLRewriting enabled

Published Feb 26, 2014

Description

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.

Affected products

Remediation

Red Hat statement

This issue did not affect JBoss Web, as shipped with various Red Hat JBoss products. The disableURLRewriting property was introduced in Apache Tomcat 6.0.30. All versions of Apache Tomcat prior to 6.0.30 are not affected by this flaw, as the affected feature is not present. Tomcat 6 as shipped with Red Hat JBoss Web Server 2.0.0 and above is affected by this flaw. Tomcat 6 as shipped with Red Hat JBoss Web Server 1.0.2 is not affected by this flaw. Tomcat 6 as shipped with Red Hat JBoss Web Server prior to 1.0.2 is not affected by this flaw, as the disableURLRewriting property is not supported. Tomcat 6 as shipped with Red Hat Enterprise Linux 6 is based on Apache Tomcat 6.0.24 and is not affected by this flaw, as this flaw was introduced only in Apache Tomcat 6.0.33.

Metrics

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-384

References (34)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Feb 26, 2014
Updated Aug 6, 2024
Reserved Dec 3, 2013
Link CVE-2014-0033
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2014-0033
Red Hat
Severity Moderate
Public date Feb 25, 2014
Links CVE-2014-0033 - Bugzilla
GHSA-6GJJ-C5MJ-4CVP