CVE:CVE-2019-17563
CNNVD:CNNVD-201912-927
Apache Tomcat是美国阿帕奇（Apache）基金会的一款轻量级Web应用服务器。该程序实现了对Servlet和JavaServer Page（JSP）的支持。
Apache Tomcat 9.0.0.M1版本至9.0.29版本、8.5.0版本至8.5.49版本和7.0.0版本至7.0.98版本中存在授权问题漏洞。攻击者可借助FORM身份验证功能利用该漏洞访问其他用户的会话。
solution:Upgrade apache tomcat to a higher version than 7.0.98,8.5.49,9.0.29,and avoid the version [7.0.0,7.0.98],[8.5.0,8.5.49],[9.0.0,9.0.29]; Upgrade debian debian_linux to a higher version than 8.0,9.0,10.0,and avoid the version 8.0,9.0,10.0; Upgrade opensuse leap to a higher version than 15.1,and avoid the version 15.1; Upgrade canonical ubuntu_linux to a higher version than 16.04,and avoid the version 16.04; Upgrade oracle agile_engineering_data_management to a higher version than 6.2.1.0,and avoid the version 6.2.1.0; Upgrade oracle hyperion_infrastructure_technology to a higher version than 11.1.2.4,and avoid the version 11.1.2.4; Upgrade oracle instantis_enterprisetrack to a higher version than 17.3,and avoid the version [17.1,17.3]; Upgrade oracle micros_relate_crm_software to a higher version than 11.4,and avoid the version 11.4; Upgrade oracle mysql_enterprise_monitor to a higher version than 4.0.11.5331,8.0.18.1217,and avoid the version (,4.0.11.5331],[8.0.0,8.0.18.1217]; Upgrade oracle retail_order_broker to a higher version than 15.0,and avoid the version 15.0; Upgrade oracle transportation_management to a higher version than 6.3.7,and avoid the version 6.3.7