Search for vulnerabilities
Vulnerability details: VCID-uj2y-34xt-hqf3
Vulnerability ID VCID-uj2y-34xt-hqf3
Aliases CVE-2025-55668
GHSA-23hv-mwm6-g8jf
Summary Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-384 Session Fixation
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 6.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55668.json
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2025-55668
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2025-55668
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2025-55668
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2025-55668
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2025-55668
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-55668
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-55668
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-55668
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-55668
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-55668
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-55668
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-55668
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-55668
apache_tomcat Moderate https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55668
cvssv3.1 6.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-23hv-mwm6-g8jf
cvssv3.1 6.5 https://github.com/apache/tomcat
generic_textual MODERATE https://github.com/apache/tomcat
cvssv3.1 6.5 https://github.com/apache/tomcat/commit/8621e4c6ba2c916a41eb34cb0f781171ead33fb6
generic_textual MODERATE https://github.com/apache/tomcat/commit/8621e4c6ba2c916a41eb34cb0f781171ead33fb6
cvssv3.1 6.5 https://github.com/apache/tomcat/commit/90306d971bb8b8393336d893644124fb2ca11d21
generic_textual MODERATE https://github.com/apache/tomcat/commit/90306d971bb8b8393336d893644124fb2ca11d21
cvssv3.1 6.5 https://github.com/apache/tomcat/commit/9c3673ba04009377cb0c81ccb6cf5078aec1aa95
generic_textual MODERATE https://github.com/apache/tomcat/commit/9c3673ba04009377cb0c81ccb6cf5078aec1aa95
cvssv3.1 6.5 https://lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47
generic_textual MODERATE https://lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47
ssvc Track https://lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2025-55668
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-55668
cvssv3.1 6.5 https://tomcat.apache.org/security-10.html
generic_textual MODERATE https://tomcat.apache.org/security-10.html
cvssv3.1 6.5 https://tomcat.apache.org/security-11.html
generic_textual MODERATE https://tomcat.apache.org/security-11.html
cvssv3.1 6.5 https://tomcat.apache.org/security-9.html
generic_textual MODERATE https://tomcat.apache.org/security-9.html
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55668.json
https://api.first.org/data/v1/epss?cve=CVE-2025-55668
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/apache/tomcat
https://github.com/apache/tomcat/commit/8621e4c6ba2c916a41eb34cb0f781171ead33fb6
https://github.com/apache/tomcat/commit/90306d971bb8b8393336d893644124fb2ca11d21
https://github.com/apache/tomcat/commit/9c3673ba04009377cb0c81ccb6cf5078aec1aa95
https://nvd.nist.gov/vuln/detail/CVE-2025-55668
https://tomcat.apache.org/security-10.html
https://tomcat.apache.org/security-11.html
https://tomcat.apache.org/security-9.html
1111098 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1111098
2388226 https://bugzilla.redhat.com/show_bug.cgi?id=2388226
CVE-2025-55668 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55668
GHSA-23hv-mwm6-g8jf https://github.com/advisories/GHSA-23hv-mwm6-g8jf
v6bknr96rl7l1qxkl1c03v0qdvbbqs47 https://lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-55668.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/apache/tomcat
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/apache/tomcat/commit/8621e4c6ba2c916a41eb34cb0f781171ead33fb6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/apache/tomcat/commit/90306d971bb8b8393336d893644124fb2ca11d21
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/apache/tomcat/commit/9c3673ba04009377cb0c81ccb6cf5078aec1aa95
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-13T13:38:12Z/ Found at https://lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-55668
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://tomcat.apache.org/security-10.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://tomcat.apache.org/security-11.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://tomcat.apache.org/security-9.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.01016
EPSS Score 0.00011
Published At Aug. 16, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-08-14T08:03:42.668849+00:00 SUSE Severity Score Importer Import https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml 37.0.0