CVE-2012-4431

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

9.15% chance of exploitation in the next 30 days, 95th percentile

Published

2012-12-19

Updated

2026-10-09

Proof-of-concept exploits (1)

• imjdl/CVE-2012-44310★ · 2018-10-28

Security advisories

• http://tomcat.apache.org/security-6.html
• http://tomcat.apache.org/security-7.html
• advisories/GHSA-76vr-72mv-mf3q
• http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/filters/CsrfPr…
• http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml?r1=1393088&r…
• http://svn.apache.org/viewvc?view=revision&revision=1393088
• http://www.securityfocus.com/bid/56814
• http://www.ubuntu.com/usn/USN-1685-1

References

• CVE Record
• NVD entry

Related

• CVE-2019-11510
• CVE-2019-16278
• CVE-2019-16728
• CVE-2020-8515
• CVE-2022-46169
• CVE-2024-57727