CVE-2015-5351

CSRF protection is like a “stop sign” that should prevent outsiders from making your web app do things on your behalf. This Tomcat issue weakens that stop sign in the Manager and Host Manager screens, so a malicious website can cause harmful actions as if the request were protected—without having to possess the expected CSRF protection. The practical risk is unauthorized administrative actions in the Tomcat management interfaces if they’re reachable and enabled.

This matters if you run Apache Tomcat and have the Manager and/or Host Manager applications enabled on versions before 7.0.68, 8.0.31, or 9.0.0.M2. It’s especially relevant if those management pages are reachable from the network (including from the internet), because an attacker can target them and bypass CSRF defenses. Reachability is the gate: it’s a risk when the Manager/Host Manager apps are enabled and reachable; there’s no need for the attacker to already have a special login.

This is urgent because attackers can bypass Tomcat’s CSRF protection for the Manager/Host Manager interfaces, and a public exploit is available. Even though KEV isn’t listed in CISA for this issue, the traffic-light verdict is AMBER, and the preconditions are straightforward for exposed, enabled management endpoints.