GoogleOSV:GHSA-2C9M-W27F-53RMApache Tomcat vulnerable to Unprotected Transport of Credentials
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
0.001 Low
EPSS
Percentile
40.1%
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.
References
bz.apache.org/bugzilla/show_bug.cgi?id=66471
github.com/apache/tomcat
github.com/apache/tomcat/commit/3b51230764da595bb19e8d0962dd8c69ab40dfab
github.com/apache/tomcat/commit/5b72c94e8b2c4ada63a1d91dc527bf4d8fd1f510
github.com/apache/tomcat/commit/c64d496dda1560b5df113be55fbfaefec349b50f
github.com/apache/tomcat/commit/f509bbf31fc00abe3d9f25ebfabca5e05173da5b
lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67
nvd.nist.gov/vuln/detail/CVE-2023-28708
tomcat.apache.org/security-10.html
tomcat.apache.org/security-11.html
tomcat.apache.org/security-8.html
tomcat.apache.org/security-9.html
Related
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
0.001 Low
EPSS
Percentile
40.1%