VULNERABILITY INTELLIGENCE
CVE-2015-5351
CVSS score8.8 HIGH
EPSS probability9.67%
CISA KEVNot currently listed
Published2016-02-25
Last modified2026-10-14
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token.
Weakness classification
- CWE-352: Cross-Site Request Forgery (CSRF)