Every CVE Search/ Get API key

CVE-2014-0033

Improper Input Validation in Apache Tomcat

4.3 MediumFix available

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.

Exploit likelihood

9.89%Up 2.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.

Record
CVE-2014-0033
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.

Record
CVE-2014-0033
Updated
2026-11-02
EUVDEUVD-2022-2794 No score

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.

Record
EUVD-2022-2794
Updated
2026-11-03
GitHub AdvisoriesGHSA-6gjj-c5mj-4cvp No score

Improper Input Validation in Apache Tomcat

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.

Record
GHSA-6gjj-c5mj-4cvp
Weakness
CWE-20
Updated
2026-11-02
OSVGHSA-6gjj-c5mj-4cvp No score

Improper Input Validation in Apache Tomcat

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.

Record
GHSA-6gjj-c5mj-4cvp
Weakness
CWE-20
Updated
2026-11-02
OSVUBUNTU-CVE-2014-0033 No score

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.

Record
UBUNTU-CVE-2014-0033
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.tomcat:tomcat
Maven
 6.0.33 up to 6.0.38
6.0.38
tomcat6
Debian:6.0
From an advisory covering 4 CVEs
 before 6.0.41-2+squeeze5, plus listed versions
6.0.28-106.0.28-96.0.28-9+squeeze16.0.32-16.0.32-2
Show 21 moreShow less
6.0.32-36.0.32-46.0.32-56.0.32-66.0.32-76.0.33-16.0.35-16.0.35-1+squeeze26.0.35-1+squeeze36.0.35-1+squeeze46.0.35-26.0.35-36.0.35-46.0.35-56.0.35-5+nmu16.0.35-66.0.35-76.0.37-16.0.39-16.0.41-16.0.41-2
6.0.41-2+squeeze5
tomcat6
Debian:7
From an advisory covering 18 CVEs
 before 6.0.45+dfsg-1~deb7u1, plus listed versions
6.0.35-66.0.35-6+deb7u16.0.35-76.0.37-16.0.39-1
Show 8 moreShow less
6.0.41-16.0.41-26.0.41-2+squeeze56.0.41-2+squeeze66.0.41-2+squeeze76.0.41-36.0.41-46.0.45-1~deb6u1
6.0.45+dfsg-1~deb7u1
tomcat6
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 4 CVEs
 before 0:6.0.37-19_patch_04.ep6.el5
0:6.0.37-19_patch_04.ep6.el5
tomcat6-admin-webapps
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 4 CVEs
 before 0:6.0.37-19_patch_04.ep6.el5
0:6.0.37-19_patch_04.ep6.el5
tomcat6-docs-webapp
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 4 CVEs
 before 0:6.0.37-19_patch_04.ep6.el5
0:6.0.37-19_patch_04.ep6.el5
tomcat6-el-2.1-api
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 4 CVEs
 before 0:6.0.37-19_patch_04.ep6.el5
0:6.0.37-19_patch_04.ep6.el5
tomcat6-javadoc
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 4 CVEs
 before 0:6.0.37-19_patch_04.ep6.el5
0:6.0.37-19_patch_04.ep6.el5
tomcat6-jsp-2.1-api
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 4 CVEs
 before 0:6.0.37-19_patch_04.ep6.el5
0:6.0.37-19_patch_04.ep6.el5
tomcat6-lib
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 4 CVEs
 before 0:6.0.37-19_patch_04.ep6.el5
0:6.0.37-19_patch_04.ep6.el5
Show 13 moreShow less
Affected packages
PackageAffectedFixed
tomcat6-log4j
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 4 CVEs
 before 0:6.0.37-19_patch_04.ep6.el5
0:6.0.37-19_patch_04.ep6.el5
tomcat6-servlet-2.5-api
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 4 CVEs
 before 0:6.0.37-19_patch_04.ep6.el5
0:6.0.37-19_patch_04.ep6.el5
tomcat6-webapps
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 4 CVEs
 before 0:6.0.37-19_patch_04.ep6.el5
0:6.0.37-19_patch_04.ep6.el5
tomcat6
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:6.0.37-27_patch_04.ep6.el6
0:6.0.37-27_patch_04.ep6.el6
tomcat6-admin-webapps
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:6.0.37-27_patch_04.ep6.el6
0:6.0.37-27_patch_04.ep6.el6
tomcat6-docs-webapp
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:6.0.37-27_patch_04.ep6.el6
0:6.0.37-27_patch_04.ep6.el6
tomcat6-el-2.1-api
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:6.0.37-27_patch_04.ep6.el6
0:6.0.37-27_patch_04.ep6.el6
tomcat6-javadoc
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:6.0.37-27_patch_04.ep6.el6
0:6.0.37-27_patch_04.ep6.el6
tomcat6-jsp-2.1-api
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:6.0.37-27_patch_04.ep6.el6
0:6.0.37-27_patch_04.ep6.el6
tomcat6-lib
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:6.0.37-27_patch_04.ep6.el6
0:6.0.37-27_patch_04.ep6.el6
tomcat6-log4j
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:6.0.37-27_patch_04.ep6.el6
0:6.0.37-27_patch_04.ep6.el6
tomcat6-servlet-2.5-api
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:6.0.37-27_patch_04.ep6.el6
0:6.0.37-27_patch_04.ep6.el6
tomcat6-webapps
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 4 CVEs
 before 0:6.0.37-27_patch_04.ep6.el6
0:6.0.37-27_patch_04.ep6.el6

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-0033 is a medium vulnerability (CVSS 4.3) in Apache Tomcat, published February 26, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.89%, the 95th percentile. Fixed in org.apache.tomcat:tomcat 6.0.38.

References

Show 45 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open