CVE-2012-4431

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

9.15% chance of exploitation in the next 30 days, 95th percentile

Published

2012-12-19

Updated

2024-08-06

Proof-of-concept exploits (1)

• imjdl/CVE-2012-44310★ · 2018-10-28

References

• CVE Record
• NVD entry

Related

• CVE-2019-11510
• CVE-2019-16278
• CVE-2019-16728
• CVE-2020-8515
• CVE-2022-46169
• CVE-2024-57727