CVE-2015-5346

Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.

• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html
• http://packetstormsecurity.com/files/135890/Apache-Tomcat-Session-Fixation.html
• http://rhn.redhat.com/errata/RHSA-2016-1089.html
• http://rhn.redhat.com/errata/RHSA-2016-2046.html
• http://rhn.redhat.com/errata/RHSA-2016-2807.html
• http://rhn.redhat.com/errata/RHSA-2016-2808.html
• http://seclists.org/bugtraq/2016/Feb/143
• http://svn.apache.org/viewvc?view=revision&revision=1713184
• http://svn.apache.org/viewvc?view=revision&revision=1713185
• http://svn.apache.org/viewvc?view=revision&revision=1713187
• http://svn.apache.org/viewvc?view=revision&revision=1723414
• http://svn.apache.org/viewvc?view=revision&revision=1723506
• http://tomcat.apache.org/security-7.htmlVendor Advisory
• http://tomcat.apache.org/security-8.htmlVendor Advisory
• http://tomcat.apache.org/security-9.htmlVendor Advisory
• http://www.debian.org/security/2016/dsa-3530
• http://www.debian.org/security/2016/dsa-3552
• http://www.debian.org/security/2016/dsa-3609
• http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
• http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
• http://www.securityfocus.com/bid/83323
• http://www.securitytracker.com/id/1035069
• http://www.ubuntu.com/usn/USN-3024-1
• https://access.redhat.com/errata/RHSA-2016:1087
• https://access.redhat.com/errata/RHSA-2016:1088
• https://bto.bluecoat.com/security-advisory/sa118
• https://bz.apache.org/bugzilla/show_bug.cgi?id=58809
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626
• https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
• https://security.gentoo.org/glsa/201705-09
• https://security.netapp.com/advisory/ntap-20180531-0001/
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html
• http://packetstormsecurity.com/files/135890/Apache-Tomcat-Session-Fixation.html
• http://rhn.redhat.com/errata/RHSA-2016-1089.html
• http://rhn.redhat.com/errata/RHSA-2016-2046.html
• http://rhn.redhat.com/errata/RHSA-2016-2807.html
• http://rhn.redhat.com/errata/RHSA-2016-2808.html
• http://seclists.org/bugtraq/2016/Feb/143
• http://svn.apache.org/viewvc?view=revision&revision=1713184
• http://svn.apache.org/viewvc?view=revision&revision=1713185
• http://svn.apache.org/viewvc?view=revision&revision=1713187
• http://svn.apache.org/viewvc?view=revision&revision=1723414
• http://svn.apache.org/viewvc?view=revision&revision=1723506
• http://tomcat.apache.org/security-7.htmlVendor Advisory
• http://tomcat.apache.org/security-8.htmlVendor Advisory
• http://tomcat.apache.org/security-9.htmlVendor Advisory
• http://www.debian.org/security/2016/dsa-3530
• http://www.debian.org/security/2016/dsa-3552
• http://www.debian.org/security/2016/dsa-3609
• http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
• http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
• http://www.securityfocus.com/bid/83323
• http://www.securitytracker.com/id/1035069
• http://www.ubuntu.com/usn/USN-3024-1
• https://access.redhat.com/errata/RHSA-2016:1087
• https://access.redhat.com/errata/RHSA-2016:1088
• https://bto.bluecoat.com/security-advisory/sa118
• https://bz.apache.org/bugzilla/show_bug.cgi?id=58809
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626
• https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
• https://security.gentoo.org/glsa/201705-09
• https://security.netapp.com/advisory/ntap-20180531-0001/

Published

Feb 25, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-5340Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8…
• CVE-2015-5341mod_scorm in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8…
• CVE-2015-5342The choice module in Moodle through 2.6.11, 2.7.x before 2.7…
• CVE-2015-5343Integer overflow in util.c in mod_dav_svn in Apache Subversi…
• CVE-2015-5344The camel-xstream component in Apache Camel before 2.15.5 an…
• CVE-2015-5345The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x…
• CVE-2015-5347Cross-site scripting (XSS) vulnerability in the getWindowOpe…
• CVE-2015-5348Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and…
• CVE-2015-5349The CSV export in Apache LDAP Studio and Apache Directory St…
• CVE-2015-5350In Garden versions 0.22.0-0.329.0, a vulnerability has been …
• CVE-2015-5351The (1) Manager and (2) Host Manager applications in Apache …
• CVE-2015-5352The x11_open_helper function in channels.c in ssh in OpenSSH…