CVE-2012-4431 Cross-Site Request Forgery in Apache Tomcat
Remote attackers can bypass CSRF protection in Apache Tomcat by sending requests without a session identifier, potentially enabling unauthorized actions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2012-4431?
CVE-2012-4431 is a medium-severity vulnerability in Apache Tomcat, published on 19 Dec 2012. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.
Weakness: CWE-264
Which versions are affected by CVE-2012-4431?
4 open source packages ship an affected version, including org.apache.tomcat:tomcat. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat:tomcat Maven | From 6.0.0 | 6.0.36 |
org.apache.tomcat:tomcat Maven | From 6.0.0 | 6.0.36 |
org.apache.tomcat:tomcat Maven | From 7.0.0 | 7.0.32 |
org.apache.tomcat:tomcat Maven | From 7.0.0 | 7.0.32 |
Linux distribution packages (20)
tomcat7 Red Hat:jboss_enterprise_web_server:2::el5 | All versions | 0:7.0.30-3_patch_02.ep6.el5 |
tomcat7-admin-webapps Red Hat:jboss_enterprise_web_server:2::el5 | All versions | 0:7.0.30-3_patch_02.ep6.el5 |
tomcat7-docs-webapp Red Hat:jboss_enterprise_web_server:2::el5 | All versions | 0:7.0.30-3_patch_02.ep6.el5 |
tomcat7-el-1.0-api Red Hat:jboss_enterprise_web_server:2::el5 | All versions | 0:7.0.30-3_patch_02.ep6.el5 |
tomcat7-javadoc Red Hat:jboss_enterprise_web_server:2::el5 | All versions | 0:7.0.30-3_patch_02.ep6.el5 |
tomcat7-jsp-2.2-api Red Hat:jboss_enterprise_web_server:2::el5 | All versions | 0:7.0.30-3_patch_02.ep6.el5 |
tomcat7-lib Red Hat:jboss_enterprise_web_server:2::el5 | All versions | 0:7.0.30-3_patch_02.ep6.el5 |
tomcat7-log4j Red Hat:jboss_enterprise_web_server:2::el5 | All versions | 0:7.0.30-3_patch_02.ep6.el5 |
tomcat7-servlet-3.0-api Red Hat:jboss_enterprise_web_server:2::el5 | All versions | 0:7.0.30-3_patch_02.ep6.el5 |
tomcat7-webapps Red Hat:jboss_enterprise_web_server:2::el5 | All versions | 0:7.0.30-3_patch_02.ep6.el5 |
tomcat7 Red Hat:jboss_enterprise_web_server:2::el6 | All versions | 0:7.0.30-5_patch_02.ep6.el6 |
tomcat7-admin-webapps Red Hat:jboss_enterprise_web_server:2::el6 | All versions | 0:7.0.30-5_patch_02.ep6.el6 |
tomcat7-docs-webapp Red Hat:jboss_enterprise_web_server:2::el6 | All versions | 0:7.0.30-5_patch_02.ep6.el6 |
tomcat7-el-1.0-api Red Hat:jboss_enterprise_web_server:2::el6 | All versions | 0:7.0.30-5_patch_02.ep6.el6 |
tomcat7-javadoc Red Hat:jboss_enterprise_web_server:2::el6 | All versions | 0:7.0.30-5_patch_02.ep6.el6 |
tomcat7-jsp-2.2-api Red Hat:jboss_enterprise_web_server:2::el6 | All versions | 0:7.0.30-5_patch_02.ep6.el6 |
tomcat7-lib Red Hat:jboss_enterprise_web_server:2::el6 | All versions | 0:7.0.30-5_patch_02.ep6.el6 |
tomcat7-log4j Red Hat:jboss_enterprise_web_server:2::el6 | All versions | 0:7.0.30-5_patch_02.ep6.el6 |
tomcat7-servlet-3.0-api Red Hat:jboss_enterprise_web_server:2::el6 | All versions | 0:7.0.30-5_patch_02.ep6.el6 |
tomcat7-webapps Red Hat:jboss_enterprise_web_server:2::el6 | All versions | 0:7.0.30-5_patch_02.ep6.el6 |
Products include Apache Tomcat.
How do I fix CVE-2012-4431?
Upgrade org.apache.tomcat:tomcat to a fixed version for your release line: 6.0.36 or 7.0.32.
Is CVE-2012-4431 being exploited?
There is no known exploitation of CVE-2012-4431 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Apache Tomcat
Sources
Also known as GHSA-76vr-72mv-mf3q, RHSA-2013:0268.