What is the CVSS score of CVE-2019-17563?

CVE-2019-17563 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 10.7%.

Is there a patch available for CVE-2019-17563?

Yes, a patch is available for CVE-2019-17563. Update the affected software to the latest version immediately.

Session Fixation CVE-2019-17563

HIGH

Session Fixation (CWE-384)

2019-12-23 security@apache.org

Session Fixation Tomcat Information Disclosure Apache Debian Linux Leap Ubuntu Linux Agile Engineering Data Management Hyperion Infrastructure Technology Instantis Enterprisetrack Micros Relate Crm Software Mysql Enterprise Monitor Retail Order Broker Transportation Management

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Dec 23, 2019 - 17:15 nvd

HIGH 7.5

DescriptionNVD

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.

AnalysisAI

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required.

Technical ContextAI

This vulnerability is classified under CWE-384. When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability. Affected products include: Apache Tomcat, Debian Debian Linux, Opensuse Leap, Canonical Ubuntu Linux, Oracle Agile Engineering Data Management.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.