CVE-2013-6357
Apache Tomcat 5.5.25 - Cross-Site Request Forgery
Severity Score
6.3
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
3
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI. NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator.
** DISPUTADO ** Vulnerabilidad de CSRF en la aplicación Manager en Apache Tomcat 5.5.25 y anteriores versiones permite a atacantes remotos secuestrar la autenticación de peticiones de administrador que manipulen la distribución de aplicaciones a través del método POST, tal tal y como se demuestra mediante la URI /manager/html/undeploy?path=. NOTA: el vendedor discute la importancia de este reporte, indicando que "el equipo de seguridad de Apache Tomcat no acepta ningún reporte de ataques CSRF contra la aplicación Manager ... ya que requieren un administrador de sistemas imprudente".
Apache Tomcat version 5.5.25 suffers from a cross site request forgery vulnerability.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2013-11-03 CVE Reserved
- 2013-11-04 CVE Published
- 2013-11-04 First Exploit
- 2024-09-16 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-352: Cross-Site Request Forgery (CSRF)
CAPEC
References (3)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://packetstorm.news/files/id/123894 | 2013-11-04 | |
| https://www.exploit-db.com/exploits/29435 | 2013-11-04 | |
| http://www.webapp-security.com/wp-content/uploads/2013/11/Apache-Tomcat-5.5.25-CSRF-Vulnerabilities.txt | 2024-09-16 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | <= 5.5.25 Search vendor "Apache" for product "Tomcat" and version " <= 5.5.25" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 1.1.3 Search vendor "Apache" for product "Tomcat" and version "1.1.3" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 3.0 Search vendor "Apache" for product "Tomcat" and version "3.0" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 3.1 Search vendor "Apache" for product "Tomcat" and version "3.1" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 3.1.1 Search vendor "Apache" for product "Tomcat" and version "3.1.1" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 3.2 Search vendor "Apache" for product "Tomcat" and version "3.2" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 3.2.1 Search vendor "Apache" for product "Tomcat" and version "3.2.1" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 3.2.2 Search vendor "Apache" for product "Tomcat" and version "3.2.2" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 3.2.2 Search vendor "Apache" for product "Tomcat" and version "3.2.2" | beta2 |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 3.2.3 Search vendor "Apache" for product "Tomcat" and version "3.2.3" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 3.2.4 Search vendor "Apache" for product "Tomcat" and version "3.2.4" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 3.3 Search vendor "Apache" for product "Tomcat" and version "3.3" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 3.3.1 Search vendor "Apache" for product "Tomcat" and version "3.3.1" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 3.3.1a Search vendor "Apache" for product "Tomcat" and version "3.3.1a" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 3.3.2 Search vendor "Apache" for product "Tomcat" and version "3.3.2" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 4 Search vendor "Apache" for product "Tomcat" and version "4" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 4.0.0 Search vendor "Apache" for product "Tomcat" and version "4.0.0" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 4.0.1 Search vendor "Apache" for product "Tomcat" and version "4.0.1" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 4.0.2 Search vendor "Apache" for product "Tomcat" and version "4.0.2" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 4.0.3 Search vendor "Apache" for product "Tomcat" and version "4.0.3" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 4.0.4 Search vendor "Apache" for product "Tomcat" and version "4.0.4" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 4.0.5 Search vendor "Apache" for product "Tomcat" and version "4.0.5" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 4.0.6 Search vendor "Apache" for product "Tomcat" and version "4.0.6" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 4.1.0 Search vendor "Apache" for product "Tomcat" and version "4.1.0" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 4.1.1 Search vendor "Apache" for product "Tomcat" and version "4.1.1" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 4.1.2 Search vendor "Apache" for product "Tomcat" and version "4.1.2" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 4.1.3 Search vendor "Apache" for product "Tomcat" and version "4.1.3" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 4.1.3 Search vendor "Apache" for product "Tomcat" and version "4.1.3" | beta |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 4.1.9 Search vendor "Apache" for product "Tomcat" and version "4.1.9" | beta |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 4.1.10 Search vendor "Apache" for product "Tomcat" and version "4.1.10" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 4.1.12 Search vendor "Apache" for product "Tomcat" and version "4.1.12" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 4.1.15 Search vendor "Apache" for product "Tomcat" and version "4.1.15" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 4.1.24 Search vendor "Apache" for product "Tomcat" and version "4.1.24" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 4.1.28 Search vendor "Apache" for product "Tomcat" and version "4.1.28" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 4.1.29 Search vendor "Apache" for product "Tomcat" and version "4.1.29" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 4.1.31 Search vendor "Apache" for product "Tomcat" and version "4.1.31" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 4.1.36 Search vendor "Apache" for product "Tomcat" and version "4.1.36" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5 Search vendor "Apache" for product "Tomcat" and version "5" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.0 Search vendor "Apache" for product "Tomcat" and version "5.0.0" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.1 Search vendor "Apache" for product "Tomcat" and version "5.0.1" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.2 Search vendor "Apache" for product "Tomcat" and version "5.0.2" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.3 Search vendor "Apache" for product "Tomcat" and version "5.0.3" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.4 Search vendor "Apache" for product "Tomcat" and version "5.0.4" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.5 Search vendor "Apache" for product "Tomcat" and version "5.0.5" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.6 Search vendor "Apache" for product "Tomcat" and version "5.0.6" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.7 Search vendor "Apache" for product "Tomcat" and version "5.0.7" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.8 Search vendor "Apache" for product "Tomcat" and version "5.0.8" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.9 Search vendor "Apache" for product "Tomcat" and version "5.0.9" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.10 Search vendor "Apache" for product "Tomcat" and version "5.0.10" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.11 Search vendor "Apache" for product "Tomcat" and version "5.0.11" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.12 Search vendor "Apache" for product "Tomcat" and version "5.0.12" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.13 Search vendor "Apache" for product "Tomcat" and version "5.0.13" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.14 Search vendor "Apache" for product "Tomcat" and version "5.0.14" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.15 Search vendor "Apache" for product "Tomcat" and version "5.0.15" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.16 Search vendor "Apache" for product "Tomcat" and version "5.0.16" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.17 Search vendor "Apache" for product "Tomcat" and version "5.0.17" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.18 Search vendor "Apache" for product "Tomcat" and version "5.0.18" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.19 Search vendor "Apache" for product "Tomcat" and version "5.0.19" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.21 Search vendor "Apache" for product "Tomcat" and version "5.0.21" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.22 Search vendor "Apache" for product "Tomcat" and version "5.0.22" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.23 Search vendor "Apache" for product "Tomcat" and version "5.0.23" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.24 Search vendor "Apache" for product "Tomcat" and version "5.0.24" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.25 Search vendor "Apache" for product "Tomcat" and version "5.0.25" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.26 Search vendor "Apache" for product "Tomcat" and version "5.0.26" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.27 Search vendor "Apache" for product "Tomcat" and version "5.0.27" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.28 Search vendor "Apache" for product "Tomcat" and version "5.0.28" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.29 Search vendor "Apache" for product "Tomcat" and version "5.0.29" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.0.30 Search vendor "Apache" for product "Tomcat" and version "5.0.30" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.0 Search vendor "Apache" for product "Tomcat" and version "5.5.0" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.1 Search vendor "Apache" for product "Tomcat" and version "5.5.1" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.2 Search vendor "Apache" for product "Tomcat" and version "5.5.2" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.3 Search vendor "Apache" for product "Tomcat" and version "5.5.3" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.4 Search vendor "Apache" for product "Tomcat" and version "5.5.4" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.5 Search vendor "Apache" for product "Tomcat" and version "5.5.5" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.6 Search vendor "Apache" for product "Tomcat" and version "5.5.6" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.7 Search vendor "Apache" for product "Tomcat" and version "5.5.7" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.8 Search vendor "Apache" for product "Tomcat" and version "5.5.8" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.9 Search vendor "Apache" for product "Tomcat" and version "5.5.9" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.10 Search vendor "Apache" for product "Tomcat" and version "5.5.10" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.11 Search vendor "Apache" for product "Tomcat" and version "5.5.11" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.12 Search vendor "Apache" for product "Tomcat" and version "5.5.12" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.13 Search vendor "Apache" for product "Tomcat" and version "5.5.13" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.14 Search vendor "Apache" for product "Tomcat" and version "5.5.14" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.15 Search vendor "Apache" for product "Tomcat" and version "5.5.15" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.16 Search vendor "Apache" for product "Tomcat" and version "5.5.16" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.17 Search vendor "Apache" for product "Tomcat" and version "5.5.17" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.18 Search vendor "Apache" for product "Tomcat" and version "5.5.18" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.19 Search vendor "Apache" for product "Tomcat" and version "5.5.19" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.20 Search vendor "Apache" for product "Tomcat" and version "5.5.20" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.21 Search vendor "Apache" for product "Tomcat" and version "5.5.21" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.22 Search vendor "Apache" for product "Tomcat" and version "5.5.22" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.23 Search vendor "Apache" for product "Tomcat" and version "5.5.23" | - |
Affected
| ||||||
| Apache Search vendor "Apache" | Tomcat Search vendor "Apache" for product "Tomcat" | 5.5.24 Search vendor "Apache" for product "Tomcat" and version "5.5.24" | - |
Affected
| ||||||