[SECURITY] CVE-2014-0033 Session fixation still possible with disableURLRewriting enabled

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-0033 Session fixation still possible with disableURLRewriting enabled Severity: Low Vendor: The Apache Software Foundation Versions Affected: - - Apache Tomcat 6.0.33 to 6.0.37 Description: Previous fixes to path parameter handling 1 introduc...

Apache Tomcat 6.0.x < 6.0.39 Multiple Vulnerabilities

Binary data 8141.pasl...

CVE-2014-0033: Improper Input Validation

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL...

Apache Tomcat 6.0.x < 6.0.39 Multiple Vulnerabilities

According to its self-reported version number, the instance of Apache Tomcat 6.0.x listening on the remote host is prior to 6.0.39. It is, therefore, affected by the following vulnerabilities : - The version of Java used to build the application generates Javadoc containing a frame injection erro...

PT-2014-3441

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 6.0.33 through 6.0.37 Description The issue allows remote attackers to conduct session fixation attacks via a crafted URL, because the disableURLRewriting setting is not considered when handling a session ID in a URL. Th...