CVE-2014-0033

描述

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.

如何修補 CVE-2014-0033

要修補 CVE-2014-0033,請將受影響套件升級到下列已修補版本。

• Maven/org.apache.tomcat:tomcat—升級至 6.0.38 或更新版本

CVE-2014-0033 正在被利用嗎?

中等 — EPSS 為 9.9%,可持續追蹤但非最高優先。

受影響套件(1)

• >= 6.0.33, < 6.0.38

參考連結(19)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2014-0033
• WEBseclists.org/fulldisclosure/2014/Dec/23
• WEBsvn.apache.org/viewvc?view=revision&revision=1558822
• WEBtomcat.apache.org/security-6.html
• WEB