| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.tomcat.embed:tomcat-embed-core | ≥ 8.0.0, < 8.5.50≥ 9.0.0, < 9.0.30< 7.0.99 | 8.5.509.0.307.0.99 |
| tomcat | ≥ 7.0.0, ≤ 7.0.98≥ 8.5.0, ≤ 8.5.49≥ 9.0.0, ≤ 9.0.29 | |
| agile engineering data management | = 6.2.1.0 | |
| hyperion infrastructure technology | = 11.1.2.4 | |
| instantis enterprisetrack | ≥ 17.1, ≤ 17.3 | |
| micros relate crm software | = 11.4 | |
| mysql enterprise monitor | ≥ 8.0.0, ≤ 8.0.18.1217≤ 4.0.11.5331 | |
| retail order broker | = 15.0 | |
| transportation management | = 6.3.7 |
When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free