CVE-2015-5346: Apache Tomcat

High severity, CVSS 8.1. EPSS: 10.6% chance of exploitation in the next 30 days.

Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.

Affected products

• Apache Tomcat: version 7.0.0 only; version 7.0.2 only; version 7.0.4 only; version 7.0.5 only; version 7.0.6 only; version 7.0.10 only; …
• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 15.10 only; version 16.04 only
• Debian Debian Linux: version 7.0 only; version 8.0 only

Published 2016-02-25. Last modified 2026-06-17.