CVE-2015-5351
- State
- Published
- Severity
- Not scored
- Published
- Feb 25, 2016
- Updated
- Oct 14, 2026
- Reserved
- Jul 1, 2015
Description
The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token.
Scores
The record has no CVSS score.
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 83330vdb-entry
- http://packetstormsecurity.com/files/135882/Apache-Tomcat-CSRF-Token-Leak.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- GLSA-201705-09vendor-advisory
- http://svn.apache.org/viewvc?view=revision&revision=1720658
- openSUSE-SU-2016:0865vendor-advisory
- http://tomcat.apache.org/security-9.html
- USN-3024-1vendor-advisory
- SUSE-SU-2016:0769vendor-advisory
- DSA-3530vendor-advisory
- http://tomcat.apache.org/security-7.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- 20160222 [SECURITY] CVE-2015-5351 Apache Tomcat CSRF token leakmailing-list
- RHSA-2016:1089vendor-advisory
- http://tomcat.apache.org/security-8.html
- RHSA-2016:1087vendor-advisory
- http://svn.apache.org/viewvc?view=revision&revision=1720655
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- 1035069vdb-entry
- https://bto.bluecoat.com/security-advisory/sa118
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442
- http://svn.apache.org/viewvc?view=revision&revision=1720663
- RHSA-2016:2807vendor-advisory
- RHSA-2016:1088vendor-advisory
- https://security.netapp.com/advisory/ntap-20180531-0001/
- RHSA-2016:2808vendor-advisory
- http://svn.apache.org/viewvc?view=revision&revision=1720661
- SUSE-SU-2016:0822vendor-advisory
- RHSA-2016:2599vendor-advisory
- DSA-3609vendor-advisory
- http://svn.apache.org/viewvc?view=revision&revision=1720652
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626
- https://softwaresupport.hpe.com/document/-/facetsearch/document/KM02978021
- DSA-3552vendor-advisory
- http://svn.apache.org/viewvc?view=revision&revision=1720660
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/mailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.