CVE-2019-17563: apache software foundation apache tomcat Session Fixation
Vulnerability summary
CVE-2019-17563 is a high (CVSS 7.5) Session Fixation vulnerability in apache software foundation apache tomcat. EPSS estimates a 10.69% chance of exploitation in the next 30 days, higher than 95.8% of scored vulnerabilities.
Not severe (CVSS 7.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 19 · Related 11Timeline
- 23-12-2019PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
10.69%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
No change 0.00 pp
From 10.69% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Oracle7 products
- agile_engineering_data_management6.2.1.0
- hyperion_infrastructure_technology11.1.2.4
- instantis_enterprisetrack≥ 17.1, ≤ 17.3
- micros_relate_crm_software11.4
- mysql_enterprise_monitor≤ 4.0.11.5331 | ≥ 8.0.0, ≤ 8.0.18.1217
Ubuntu3 products
- tomcat7All versions (No fix recorded)
- tomcat8< 8.0.32-1ubuntu1.11 | All versions (No fix recorded)
- tomcat9All versions (No fix recorded)
Debian2 products
- tomcat9< 9.0.31-1
- debian_linuxEOL8.0 | 9.0 | 10.0
Apache1 product
- tomcat≥ 7.0.0, ≤ 7.0.98 | ≥ 8.5.0, ≤ 8.5.49 | ≥ 9.0.0, ≤ 9.0.29
Apache software foundation1 product
- apache tomcat9.0.0.M1 to 9.0.29 | 8.5.0 to 8.5.49 | 7.0.0 to 7.0.98
Canonical1 product
- ubuntu_linuxEOL16.04
Opensuse1 product
- leapEOL15.1
Org.apache.tomcat.embed1 product
- tomcat-embed-core< 7.0.99 | ≥ 8.0.0, < 8.5.50 | ≥ 9.0.0, < 9.0.30
8 vendors · 17 products
References
33 links
- lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.htmlVendor AdvisoryX Refsource SUSEWEBThird Party Advisory
- lists.debian.org/debian-lts-announce/2020/01/msg00024.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
Show all 33 references
- lists.debian.org/debian-lts-announce/2020/05/msg00026.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
- github.com/apache/tomcatPACKAGE