{"id":"CVE-2012-4431","aliases":["EUVD-2022-2929","GHSA-76vr-72mv-mf3q","RHSA-2013:0266","RHSA-2013:0268","RHSA-2013:0647"],"status":"published","title":"Cross-Site Request Forgery in Apache Tomcat","description":"org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.09146,"percentile":0.95356,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-264","CWE-352"],"published":"2012-12-19T11:00:00Z","modified":"2026-10-09T20:17:04Z","exploits":[{"source":"pocgithub","id":"imjdl/CVE-2012-4431","title":"imjdl/CVE-2012-4431","date":"2019-07-03","url":"https://github.com/imjdl/CVE-2012-4431"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","fixed_in":["6.0.36","7.0.32"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7","fixed_in":["0:7.0.30-3_patch_02.ep6.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-admin-webapps","fixed_in":["0:7.0.30-3_patch_02.ep6.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-docs-webapp","fixed_in":["0:7.0.30-3_patch_02.ep6.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-el-1.0-api","fixed_in":["0:7.0.30-3_patch_02.ep6.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-javadoc","fixed_in":["0:7.0.30-3_patch_02.ep6.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-jsp-2.2-api","fixed_in":["0:7.0.30-3_patch_02.ep6.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-lib","fixed_in":["0:7.0.30-3_patch_02.ep6.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-log4j","fixed_in":["0:7.0.30-3_patch_02.ep6.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-servlet-3.0-api","fixed_in":["0:7.0.30-3_patch_02.ep6.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-webapps","fixed_in":["0:7.0.30-3_patch_02.ep6.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7","fixed_in":["0:7.0.30-5_patch_02.ep6.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-admin-webapps","fixed_in":["0:7.0.30-5_patch_02.ep6.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-docs-webapp","fixed_in":["0:7.0.30-5_patch_02.ep6.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-el-1.0-api","fixed_in":["0:7.0.30-5_patch_02.ep6.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-javadoc","fixed_in":["0:7.0.30-5_patch_02.ep6.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-jsp-2.2-api","fixed_in":["0:7.0.30-5_patch_02.ep6.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-lib","fixed_in":["0:7.0.30-5_patch_02.ep6.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-log4j","fixed_in":["0:7.0.30-5_patch_02.ep6.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-servlet-3.0-api","fixed_in":["0:7.0.30-5_patch_02.ep6.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-webapps","fixed_in":["0:7.0.30-5_patch_02.ep6.el6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.36"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.32"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.36"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.32"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-6_patch_06.ep6.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.35-29_patch_06.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.30-3_patch_02.ep6.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.30-3_patch_02.ep6.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.30-3_patch_02.ep6.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.30-3_patch_02.ep6.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.30-3_patch_02.ep6.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.30-3_patch_02.ep6.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.30-3_patch_02.ep6.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.30-3_patch_02.ep6.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.30-3_patch_02.ep6.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.30-3_patch_02.ep6.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.30-5_patch_02.ep6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.30-5_patch_02.ep6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.30-5_patch_02.ep6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.30-5_patch_02.ep6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.30-5_patch_02.ep6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.30-5_patch_02.ep6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.30-5_patch_02.ep6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.30-5_patch_02.ep6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.30-5_patch_02.ep6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.30-5_patch_02.ep6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.17-4.Final_redhat_3.ep6.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"jbossweb-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.17-4.Final_redhat_3.ep6.el5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbossweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.17-4.Final_redhat_3.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"jbossweb-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.17-4.Final_redhat_3.ep6.el6"}]}],"bundled":4}],"products":[{"vendor":"apache","product":"tomcat"}],"references":[{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18541","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=136612293908376\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2012-12/0045.html","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-01/msg00051.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-1685-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/56814","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-01/msg00080.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03748878","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0268.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://tomcat.apache.org/security-7.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web","article"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0648.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://www.securitytracker.com/id?1027834","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1437.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/filters/CsrfPreventionFilter.java?r1=1393088\u0026r2=1393087\u0026pathrev=1393088","tags":["x_refsource_CONFIRM","x_transferred","Patch","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0647.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://tomcat.apache.org/security-6.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web","article"]},{"url":"http://secunia.com/advisories/57126","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1853.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml?r1=1393088\u0026r2=1393087\u0026pathrev=1393088","tags":["x_refsource_CONFIRM","x_transferred","Patch","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0267.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1393088","tags":["x_refsource_CONFIRM","x_transferred","Patch","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=139344343412337\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-4431","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-76vr-72mv-mf3q"},{"url":"https://github.com/apache/tomcat","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0266","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=873664","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=873695","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=883636","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=883637","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0266.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-2733","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-2733","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-2733","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-4431","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-4431","tags":["advisory"]},{"url":"http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.36","tags":["article"]},{"url":"http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.32","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-4534","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-4534","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-4534","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-5885","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-5885","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5885","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-5886","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-5886","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5886","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-5887","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-5887","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5887","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0268","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0268.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0647","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0647.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2012-4431","description":"org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.","status":"published","published":"2012-12-19T11:00:00Z","modified":"2026-10-09T19:07:55.074Z","updated_at":"2026-11-02T14:34:51.937988Z"}],"euvd":[{"id":"EUVD-2022-2929","description":"org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.","status":"published","published":"2012-12-19T11:00:00Z","modified":"2026-10-09T19:07:55Z","updated_at":"2026-11-02T17:27:24.157251Z"}],"ghsa":[{"id":"GHSA-76vr-72mv-mf3q","title":"Cross-Site Request Forgery in Apache Tomcat","description":"org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.","status":"published","published":"2022-05-17T00:57:51Z","modified":"2023-01-27T05:02:35Z","cwes":["CWE-352"],"updated_at":"2026-11-02T14:36:19.144959Z"}],"nvd":[{"id":"CVE-2012-4431","description":"org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.","status":"published","published":"2012-12-19T11:55:54.577Z","modified":"2026-10-09T20:17:04.243Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:16.958223Z"}],"osv":[{"id":"GHSA-76vr-72mv-mf3q","title":"Cross-Site Request Forgery in Apache Tomcat","description":"org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.","status":"published","published":"2022-05-17T00:57:51Z","modified":"2023-11-08T03:57:07.644202Z","cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:40.657155Z"},{"id":"RHSA-2013:0266","title":"Red Hat Security Advisory: tomcat6 security update","status":"published","published":"2024-09-15T20:35:16Z","modified":"2026-08-05T10:02:02Z","updated_at":"2026-11-02T15:53:01.495018Z"},{"id":"RHSA-2013:0268","title":"Red Hat Security Advisory: tomcat7 security update","status":"published","published":"2024-09-15T20:35:25Z","modified":"2026-08-05T10:02:02Z","updated_at":"2026-11-02T15:53:01.495018Z"},{"id":"RHSA-2013:0647","title":"Red Hat Security Advisory: jbossweb security update","status":"published","published":"2024-09-15T20:35:29Z","modified":"2026-08-05T10:02:09Z","updated_at":"2026-11-02T15:53:01.993625Z"}]}}