CVE-2008-0128

2008-01-2300:00:00

ubuntu.com

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

60.8%

JSON

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in
Apache Tomcat before 5.5.21 does not set the secure flag for the
JSESSIONIDSSO cookie in an https session, which can cause the cookie to be
sent in http requests and make it easier for remote attackers to capture
this cookie.