UpHeron
All vulnerabilities

Servers and applications

CVE-2015-5346

Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.

Severity
High 8.1
Published
25 Feb 2016
Last changed
14 Oct 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • Version 9.0.0-milestone1
  • Version 8.0.29
  • Version 8.0.28
  • Version 8.0.27
All 66 release lines
  • Version 7.0.0-beta
  • Version 7.0.2-beta
  • Version 7.0.4-beta
  • Version 7.0.5-beta
  • Version 7.0.6
  • Version 7.0.10
  • Version 7.0.11
  • Version 7.0.12
  • Version 7.0.14
  • Version 7.0.16
  • Version 7.0.19
  • Version 7.0.20
  • Version 7.0.21
  • Version 7.0.22
  • Version 7.0.23
  • Version 7.0.25
  • Version 7.0.26
  • Version 7.0.27
  • Version 7.0.28
  • Version 7.0.29
  • Version 7.0.30
  • Version 7.0.32
  • Version 7.0.33
  • Version 7.0.34
  • Version 7.0.35
  • Version 7.0.37
  • Version 7.0.39
  • Version 7.0.40
  • Version 7.0.41
  • Version 7.0.42
  • Version 7.0.47
  • Version 7.0.50
  • Version 7.0.52
  • Version 7.0.53
  • Version 7.0.54
  • Version 7.0.55
  • Version 7.0.56
  • Version 7.0.57
  • Version 7.0.59
  • Version 7.0.61
  • Version 7.0.62
  • Version 7.0.63
  • Version 7.0.64
  • Version 7.0.65
  • Version 8.0.0-rc1
  • Version 8.0.0-rc3
  • Version 8.0.0-rc5
  • Version 8.0.0-rc10
  • Version 8.0.1
  • Version 8.0.3
  • Version 8.0.11
  • Version 8.0.12
  • Version 8.0.14
  • Version 8.0.15
  • Version 8.0.17
  • Version 8.0.18
  • Version 8.0.20
  • Version 8.0.21
  • Version 8.0.22
  • Version 8.0.23
  • Version 8.0.24
  • Version 8.0.26
  • Version 8.0.27
  • Version 8.0.28
  • Version 8.0.29
  • Version 9.0.0-milestone1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2015-5346
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2015-5346