Description
Apache Tomcat default installation contains the "/examples" directory which has many example servlets and JSPs.
Some of these examples are a security risk and should not be deployed on a production server.
The Sessions Example servlet (installed at /examples/servlets/servlet/SessionExample) allows session manipulation. Because the session is global this servlet poses a big security risk as an attacker can potentitally become an administrator by manipulating its session.
Remediation
Disable public access to the examples directory.
References
Related Vulnerabilities
Ruby on Rails Improper Input Validation Vulnerability (CVE-2008-7248)
Microsoft SQL Server Permissions, Privileges, and Access Controls Vulnerability (CVE-2003-0230)
Plone CMS Other Vulnerability (CVE-2006-4247)
Oracle JRE CVE-2012-0502 Vulnerability (CVE-2012-0502)
OpenSSL NULL Pointer Dereference Vulnerability (CVE-2008-1672)