CVE-2023-28708

2023-03-2211:15:10

CWE-523

[email protected]

web.nvd.nist.gov

cve-2023-28708

reverse proxy

x-forwarded-proto

session cookies

insecure channel

apache tomcat 11

apache tomcat 10

apache tomcat 9

apache tomcat 8.5

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

AI Score

5.8

Confidence

High

EPSS

0.001

Percentile

40.4%

JSON

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.

Affected configurations

Nvd

Node

apachetomcatRange8.5.0–8.5.86

apachetomcatRange9.0.0–9.0.72

apachetomcatRange10.1.0–10.1.6

apachetomcatMatch11.0.0milestone1

apachetomcatMatch11.0.0milestone2

VendorProductVersionCPE
apachetomcat*cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
apachetomcat11.0.0cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*
apachetomcat11.0.0cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	tomcat	*	cpe:2.3:a:apache:tomcat::::::::
apache	tomcat	11.0.0	cpe:2.3:a:apache:tomcat:11.0.0:milestone1::::::
apache	tomcat	11.0.0	cpe:2.3:a:apache:tomcat:11.0.0:milestone2::::::