Apache Tomcat Session Fixation Vulnerability via Rewrite Valve

A session fixation vulnerability has been identified in Apache Tomcat versions 11.0.0-M1 through 11.0.7, 10.1.0-M1 through 10.1.41, and 9.0.0.M1 through 9.0.105. Older, end-of-life versions may also be affected. When the rewrite valve was enabled for a web application, an attacker could craft a URL that, if clicked by a victim, would result in the victim's session being hijacked and their interactions with the resource being conducted under the attacker's session.

Impact

Exploitation of this vulnerability allows for session fixation, where an attacker can hijack a user's session and interact with resources on their behalf.

Remediation

Users are advised to upgrade to Apache Tomcat 11.0.8, 10.1.42, or 9.0.106.