CVE-2012-4431

תיאור (מקור, אנגלית)

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

מדדים

EPSS — סבירות ניצול

9% (אחוזון 100) נכון ל-12/10/2026

CWE

CWE-264

מוצרים מושפעים

apache: tomcat

קישורים

• http://tomcat.apache.org/security-6.html Vendor Advisory
• http://tomcat.apache.org/security-7.html Vendor Advisory
• http://tomcat.apache.org/security-6.html Vendor Advisory
• http://tomcat.apache.org/security-7.html Vendor Advisory
• http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/fil‮… Patch
• http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml?r‮… Patch
• http://svn.apache.org/viewvc?view=revision&revision=1393088 Patch
• http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/fil‮… Patch
• http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml?r‮… Patch
• http://svn.apache.org/viewvc?view=revision&revision=1393088 Patch