Lucene search
F5F5:K000133402HistoryApr 05, 2023 - 12:00 a.m.
K000133402 : Apache Tomcat vulnerability CVE-2023-28708
2023-04-0500:00:00
my.f5.com
10
apache tomcat
vulnerability
remoteipfilter
insecure channel
session cookie
Security Advisory Description
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. (CVE-2023-28708)
Impact
This vulnerability may result in the user agent transmitting the session cookie over an insecure channel.
Related
tomcat
tomcat
Fixed in Apache Tomcat 9.0.72
2023-02-23 00:00:00
Fixed in Apache Tomcat 8.5.86
2023-02-24 00:00:00
Fixed in Apache Tomcat 10.1.6
2023-02-24 00:00:00
osv
osv
CVE-2023-28708
2023-03-22 11:15:10
BIT-tomcat-2023-28708
2024-03-06 11:08:55
Apache Tomcat vulnerable to Unprotected Transport of Credentials
2023-03-22 12:30:16
ibm
ibm
Security Bulletin: Vulnerability in Apache Tomcat affects App Connect Professional.
2023-04-06 05:58:30
Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an information exposure in Apache Tomcat (CVE-2023-28708)
2023-06-28 19:56:06
Security Bulletin: IBM UrbanCode Build is vulnerable to CVE-2023-28708
2023-09-05 08:10:51
cve
cve
CVE-2023-28708
2023-03-22 11:15:10
ubuntucve
ubuntucve
CVE-2023-28708
2023-03-22 00:00:00
debiancve
debiancve
CVE-2023-28708
2023-03-22 11:15:10
nessus
nessus
SUSE SLES15 Security Update : tomcat (SUSE-SU-2023:1669-1)
2023-03-30 00:00:00
Apache Tomcat 9.0.0.M1 < 9.0.72
2023-03-22 00:00:00
Apache Tomcat 10.1.0.M1 < 10.1.6
2023-03-22 00:00:00
openvas
openvas
Apache Tomcat Information Disclosure Vulnerability (Mar 2023) - Windows
2023-03-23 00:00:00
SUSE: Security Advisory (SUSE-SU-2023:1672-1)
2023-03-30 00:00:00
Apache Tomcat Information Disclosure Vulnerability (Mar 2023) - Linux
2023-03-23 00:00:00
kaspersky
kaspersky
KLA48634 OSI vulnerability in Apache Tomcat
2023-02-23 00:00:00
KLA48635 OSI vulnerability in Apache Tomcat
2023-02-24 00:00:00
redhatcve
redhatcve
CVE-2023-28708
2023-03-24 13:07:53
nvd
nvd
CVE-2023-28708
2023-03-22 11:15:10
veracode
veracode
Information Disclosure
2023-03-24 01:12:16
cvelist
cvelist
github
github
Apache Tomcat vulnerable to Unprotected Transport of Credentials
2023-03-22 12:30:16
atlassian
atlassian
Upgrade Tomcat for CVE-2023-28708
2023-03-23 22:22:39
Upgrade Tomcat for CVE-2023-28708
2023-03-27 12:10:30
prion
prion
Authentication flaw
2023-03-22 11:15:00
photon
photon
Moderate Photon OS Security Update - PHSA-2023-3.0-0581
2023-05-17 00:00:00
Moderate Photon OS Security Update - PHSA-2023-4.0-0393
2023-05-17 00:00:00
amazon
amazon
Important: tomcat8
2023-04-13 19:01:00
Important: tomcat
2023-04-27 18:36:00
debian
debian
[SECURITY] [DLA 3384-1] tomcat9 security update
2023-04-05 19:47:04
[SECURITY] [DSA 5381-1] tomcat9 security update
2023-04-05 20:07:07
almalinux
almalinux
Moderate: tomcat security and bug fix update
2023-11-14 00:00:00
Moderate: tomcat security and bug fix update
2023-11-07 00:00:00
oraclelinux
oraclelinux
tomcat security and bug fix update
2023-11-11 00:00:00
tomcat security and bug fix update
2023-11-17 00:00:00
redhat
redhat
(RHSA-2023:7065) Moderate: tomcat security and bug fix update
2023-11-14 08:44:23
(RHSA-2023:6570) Moderate: tomcat security and bug fix update
2023-11-07 06:08:48
mageia
mageia
Updated tomcat packages fix security vulnerability
2023-04-15 22:03:44
rosalinux
rosalinux
Advisory ROSA-SA-2023-2258
2023-10-21 16:49:43
oracle
oracle
Oracle Critical Patch Update Advisory - October 2023
2023-10-17 00:00:00
Oracle Critical Patch Update Advisory - July 2023
2023-07-18 00:00:00
Oracle Critical Patch Update Advisory - April 2024
2024-04-16 00:00:00