Every CVE Search/ Get API key

CVE-2012-4431

Cross-Site Request Forgery in Apache Tomcat

4.3 MediumPublic exploitFix available

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

Exploit likelihood

9.15%Down 36.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

Record
CVE-2012-4431
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

Record
CVE-2012-4431
Updated
2026-11-02
EUVDEUVD-2022-2929 No score

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

Record
EUVD-2022-2929
Updated
2026-11-02
GitHub AdvisoriesGHSA-76vr-72mv-mf3q No score

Cross-Site Request Forgery in Apache Tomcat

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

Record
GHSA-76vr-72mv-mf3q
Weakness
CWE-352
Updated
2026-11-02
OSVGHSA-76vr-72mv-mf3q No score

Cross-Site Request Forgery in Apache Tomcat

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

Record
GHSA-76vr-72mv-mf3q
Weakness
CWE-352
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.tomcat:tomcat
Maven
 6.0.0 up to 6.0.36
6.0.36
org.apache.tomcat:tomcat
Maven
 7.0.0 up to 7.0.32
7.0.32
tomcat6
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 6 CVEs
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-admin-webapps
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 6 CVEs
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-docs-webapp
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 6 CVEs
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-el-1.0-api
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 6 CVEs
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-javadoc
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 6 CVEs
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-jsp-2.1-api
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 6 CVEs
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-lib
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 6 CVEs
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-log4j
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 6 CVEs
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
Show 36 moreShow less
Affected packages
PackageAffectedFixed
tomcat6-servlet-2.5-api
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 6 CVEs
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-webapps
Red Hat:jboss_enterprise_web_server:2::el5
From an advisory covering 6 CVEs
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 6 CVEs
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-admin-webapps
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 6 CVEs
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-docs-webapp
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 6 CVEs
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-el-1.0-api
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 6 CVEs
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-javadoc
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 6 CVEs
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-jsp-2.1-api
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 6 CVEs
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-lib
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 6 CVEs
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-log4j
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 6 CVEs
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-servlet-2.5-api
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 6 CVEs
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-webapps
Red Hat:jboss_enterprise_web_server:2::el6
From an advisory covering 6 CVEs
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat7
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:7.0.30-3_patch_02.ep6.el5
0:7.0.30-3_patch_02.ep6.el5
tomcat7-admin-webapps
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:7.0.30-3_patch_02.ep6.el5
0:7.0.30-3_patch_02.ep6.el5
tomcat7-docs-webapp
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:7.0.30-3_patch_02.ep6.el5
0:7.0.30-3_patch_02.ep6.el5
tomcat7-el-1.0-api
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:7.0.30-3_patch_02.ep6.el5
0:7.0.30-3_patch_02.ep6.el5
tomcat7-javadoc
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:7.0.30-3_patch_02.ep6.el5
0:7.0.30-3_patch_02.ep6.el5
tomcat7-jsp-2.2-api
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:7.0.30-3_patch_02.ep6.el5
0:7.0.30-3_patch_02.ep6.el5
tomcat7-lib
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:7.0.30-3_patch_02.ep6.el5
0:7.0.30-3_patch_02.ep6.el5
tomcat7-log4j
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:7.0.30-3_patch_02.ep6.el5
0:7.0.30-3_patch_02.ep6.el5
tomcat7-servlet-3.0-api
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:7.0.30-3_patch_02.ep6.el5
0:7.0.30-3_patch_02.ep6.el5
tomcat7-webapps
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:7.0.30-3_patch_02.ep6.el5
0:7.0.30-3_patch_02.ep6.el5
tomcat7
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:7.0.30-5_patch_02.ep6.el6
0:7.0.30-5_patch_02.ep6.el6
tomcat7-admin-webapps
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:7.0.30-5_patch_02.ep6.el6
0:7.0.30-5_patch_02.ep6.el6
tomcat7-docs-webapp
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:7.0.30-5_patch_02.ep6.el6
0:7.0.30-5_patch_02.ep6.el6
tomcat7-el-1.0-api
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:7.0.30-5_patch_02.ep6.el6
0:7.0.30-5_patch_02.ep6.el6
tomcat7-javadoc
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:7.0.30-5_patch_02.ep6.el6
0:7.0.30-5_patch_02.ep6.el6
tomcat7-jsp-2.2-api
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:7.0.30-5_patch_02.ep6.el6
0:7.0.30-5_patch_02.ep6.el6
tomcat7-lib
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:7.0.30-5_patch_02.ep6.el6
0:7.0.30-5_patch_02.ep6.el6
tomcat7-log4j
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:7.0.30-5_patch_02.ep6.el6
0:7.0.30-5_patch_02.ep6.el6
tomcat7-servlet-3.0-api
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:7.0.30-5_patch_02.ep6.el6
0:7.0.30-5_patch_02.ep6.el6
tomcat7-webapps
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:7.0.30-5_patch_02.ep6.el6
0:7.0.30-5_patch_02.ep6.el6
jbossweb
Red Hat:jboss_enterprise_application_platform:6::el5
From an advisory covering 4 CVEs
 before 0:7.0.17-4.Final_redhat_3.ep6.el5
0:7.0.17-4.Final_redhat_3.ep6.el5
jbossweb-lib
Red Hat:jboss_enterprise_application_platform:6::el5
From an advisory covering 4 CVEs
 before 0:7.0.17-4.Final_redhat_3.ep6.el5
0:7.0.17-4.Final_redhat_3.ep6.el5
jbossweb
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 4 CVEs
 before 0:7.0.17-4.Final_redhat_3.ep6.el6
0:7.0.17-4.Final_redhat_3.ep6.el6
jbossweb-lib
Red Hat:jboss_enterprise_application_platform:6::el6
From an advisory covering 4 CVEs
 before 0:7.0.17-4.Final_redhat_3.ep6.el6
0:7.0.17-4.Final_redhat_3.ep6.el6

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubimjdl/CVE-2012-44312019-07-03

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-4431 is a medium vulnerability (CVSS 4.3) in Apache Tomcat, published December 19, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.15%, the 95th percentile. Fixed in org.apache.tomcat:tomcat 6.0.36.

References

Show 50 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open