CVE-2015-5351EPSS p95.5%

CVE-2015-5351CVE-2015-5351

apache / tomcat

Description

The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token.

Scoring

CVSS 8.8 ()
VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS9.67% probability of exploitation · percentile 95.5% · 2026-10-17T12:00:28Z
Last modified2026-10-14
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.