Every CVE Search/ Get API key

CVE-2012-4431

Cross-Site Request Forgery in Apache Tomcat

4.3 MediumPublic exploitFix available

CVE-2012-4431 is a medium vulnerability (CVSS 4.3) in Apache Tomcat, published December 19, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.15%, the 95th percentile. Fixed in org.apache.tomcat:tomcat 6.0.36.

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

Exploit likelihood

9.15%Down 36.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

Record
CVE-2012-4431
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

Record
CVE-2012-4431
Updated
2026-11-02
EUVDEUVD-2022-2929 No score

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

Record
EUVD-2022-2929
Updated
2026-11-02
GitHub AdvisoriesGHSA-76vr-72mv-mf3q No score

Cross-Site Request Forgery in Apache Tomcat

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

Record
GHSA-76vr-72mv-mf3q
Weakness
CWE-352
Updated
2026-11-02
OSVGHSA-76vr-72mv-mf3q No score

Cross-Site Request Forgery in Apache Tomcat

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

Record
GHSA-76vr-72mv-mf3q
Weakness
CWE-352
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.tomcat:tomcat
Maven
 6.0.0 up to 6.0.36
6.0.36
org.apache.tomcat:tomcat
Maven
 7.0.0 up to 7.0.32
7.0.32
tomcat6
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-admin-webapps
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-docs-webapp
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-el-1.0-api
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-javadoc
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-jsp-2.1-api
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-lib
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-log4j
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
Show 36 moreShow less
Affected packages
PackageAffectedFixed
tomcat6-servlet-2.5-api
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6-webapps
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:6.0.35-6_patch_06.ep6.el5
0:6.0.35-6_patch_06.ep6.el5
tomcat6
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-admin-webapps
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-docs-webapp
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-el-1.0-api
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-javadoc
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-jsp-2.1-api
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-lib
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-log4j
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-servlet-2.5-api
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat6-webapps
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:6.0.35-29_patch_06.ep6.el6
0:6.0.35-29_patch_06.ep6.el6
tomcat7
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:7.0.30-3_patch_02.ep6.el5
0:7.0.30-3_patch_02.ep6.el5
tomcat7-admin-webapps
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:7.0.30-3_patch_02.ep6.el5
0:7.0.30-3_patch_02.ep6.el5
tomcat7-docs-webapp
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:7.0.30-3_patch_02.ep6.el5
0:7.0.30-3_patch_02.ep6.el5
tomcat7-el-1.0-api
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:7.0.30-3_patch_02.ep6.el5
0:7.0.30-3_patch_02.ep6.el5
tomcat7-javadoc
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:7.0.30-3_patch_02.ep6.el5
0:7.0.30-3_patch_02.ep6.el5
tomcat7-jsp-2.2-api
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:7.0.30-3_patch_02.ep6.el5
0:7.0.30-3_patch_02.ep6.el5
tomcat7-lib
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:7.0.30-3_patch_02.ep6.el5
0:7.0.30-3_patch_02.ep6.el5
tomcat7-log4j
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:7.0.30-3_patch_02.ep6.el5
0:7.0.30-3_patch_02.ep6.el5
tomcat7-servlet-3.0-api
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:7.0.30-3_patch_02.ep6.el5
0:7.0.30-3_patch_02.ep6.el5
tomcat7-webapps
Red Hat:jboss_enterprise_web_server:2::el5
 before 0:7.0.30-3_patch_02.ep6.el5
0:7.0.30-3_patch_02.ep6.el5
tomcat7
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:7.0.30-5_patch_02.ep6.el6
0:7.0.30-5_patch_02.ep6.el6
tomcat7-admin-webapps
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:7.0.30-5_patch_02.ep6.el6
0:7.0.30-5_patch_02.ep6.el6
tomcat7-docs-webapp
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:7.0.30-5_patch_02.ep6.el6
0:7.0.30-5_patch_02.ep6.el6
tomcat7-el-1.0-api
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:7.0.30-5_patch_02.ep6.el6
0:7.0.30-5_patch_02.ep6.el6
tomcat7-javadoc
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:7.0.30-5_patch_02.ep6.el6
0:7.0.30-5_patch_02.ep6.el6
tomcat7-jsp-2.2-api
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:7.0.30-5_patch_02.ep6.el6
0:7.0.30-5_patch_02.ep6.el6
tomcat7-lib
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:7.0.30-5_patch_02.ep6.el6
0:7.0.30-5_patch_02.ep6.el6
tomcat7-log4j
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:7.0.30-5_patch_02.ep6.el6
0:7.0.30-5_patch_02.ep6.el6
tomcat7-servlet-3.0-api
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:7.0.30-5_patch_02.ep6.el6
0:7.0.30-5_patch_02.ep6.el6
tomcat7-webapps
Red Hat:jboss_enterprise_web_server:2::el6
 before 0:7.0.30-5_patch_02.ep6.el6
0:7.0.30-5_patch_02.ep6.el6
jbossweb
Red Hat:jboss_enterprise_application_platform:6::el5
 before 0:7.0.17-4.Final_redhat_3.ep6.el5
0:7.0.17-4.Final_redhat_3.ep6.el5
jbossweb-lib
Red Hat:jboss_enterprise_application_platform:6::el5
 before 0:7.0.17-4.Final_redhat_3.ep6.el5
0:7.0.17-4.Final_redhat_3.ep6.el5
jbossweb
Red Hat:jboss_enterprise_application_platform:6::el6
 before 0:7.0.17-4.Final_redhat_3.ep6.el6
0:7.0.17-4.Final_redhat_3.ep6.el6
jbossweb-lib
Red Hat:jboss_enterprise_application_platform:6::el6
 before 0:7.0.17-4.Final_redhat_3.ep6.el6
0:7.0.17-4.Final_redhat_3.ep6.el6

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubimjdl/CVE-2012-44312019-07-03

History

History
WhenChangedSources
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

References

Show 50 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open