When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where…

Description

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.

Scores

EPSS (exploitation in 30 days)

10.7% · top 4.2% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• Session fixation
• CWE-384 (opens in a new tab)All about CWE-384 and its CVEs

Affected products

• Apache Software Foundation · Apache Tomcat

  • affected 9.0.0.M1 to 9.0.29
  • affected 8.5.0 to 8.5.49
  • affected 7.0.0 to 7.0.98

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenorg.apache.tomcat.embed:tomcat-embed-coreGHSA-9xcj-c8cr-8c3c (opens in a new tab)

References (19)

• DSA-4596 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• 20191229 [SECURITY] [DSA 4596-1] tomcat8 security update (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• openSUSE-SU-2020:0038 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• [debian-lts-announce] 20200127 [SECURITY] [DLA 2077-1] tomcat7 security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• USN-4251-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• [tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• GLSA-202003-43 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
• DSA-4680 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• [debian-lts-announce] 20200528 [SECURITY] [DLA 2209-1] tomcat8 security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/security-alerts/cpuapr2020.html (opens in a new tab)x_refsource_MISCx_transferred
• [cxf-issues] 20200618 [jira] [Created] (FEDIZ-249) Relying party rejects a valid security token and redirects back to ADFS when using Fediz 1.4.6 with Tomcat 8.5.56 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/security-alerts/cpujul2020.html (opens in a new tab)x_refsource_MISCx_transferred
• https://lists.apache.org/thread.html/8b4c1db8300117b28a0f3f743c0b9e3f964687a690cdf9662a884bbd%40%3Cannounce.tomcat.apache.org%3E (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://security.netapp.com/advisory/ntap-20200107-0001/ (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://www.oracle.com/security-alerts/cpujan2021.html (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-9xcj-c8cr-8c3c (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2019-17563](https://trackcve.app/badge/CVE-2019-17563.svg)](https://trackcve.app/cve/CVE-2019-17563)

Record last updated 8 Oct 2026, 21:03 UTC.