VulnIntel

CVE-2025-55668

CVSS 6.5 · MEDIUM
EPSS p17
Lower risk — in the top 83% least-likely-to-be-exploited CVEs.
Patch available
Vendor advisory or patch linked

Published 8/13/2025 · updated 11/4/2025 · CWE-384

Share
Get asset-aware triage

Summary

Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

CVSS 6.5 — MEDIUM

6.5 / 10
  • AV: Network
  • AC: Low complexity
  • PR: No privileges
  • UI: User interaction
  • S: Scope unchanged
  • C: Confidentiality: High
  • I: Integrity: None
  • A: Availability: None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS exploitation probability

0.1%

Percentile p17 — Lower risk — in the top 83% least-likely-to-be-exploited CVEs.

Affected products

1 vendor/product entries
  • Apache Tomcat≥ 9.0.1 and < 9.0.106
Do you run any of these? Sign in to match this CVE against your SBOM and asset inventory automatically.

Timeline

  1. Aug 13, 2025 · Disclosed / published in NVD
  2. Nov 4, 2025 · Intel last updated

Intel sources

Which upstream feeds returned data for this CVE, and when they were last fetched.

  • NVD· 53 days ago
  • CVE.org· no data
  • FIRST EPSS· 53 days ago
  • CISA KEV· no data
  • OSV· 53 days ago

References

Vendor & CERT advisories1
Other1

Unlock the full report

See how CVE-2025-55668 hits your stack.

Free public data ends here. Sign in to correlate this CVE against your SBOM and assets, get an AI-grounded exploit chain, generate a ModSecurity virtual patch, and share findings with your team.

  • · Asset-aware CVSS & priority
  • · Grounded AI analysis (A–D graded)
  • · Auto-generated WAF / IPS rules
  • · Jira, SIEM, Slack, Teams delivery

No credit card · 100 free enrichments · analyst-grade citations.