Lucene search

K

Veracode Vulnerability DatabaseVERACODE:39930

HistoryMar 24, 2023 - 1:12 a.m.

Information Disclosure

2023-03-2401:12:16

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

18

information disclosure

tomcat

catalina

remoteipfilter

x-forwarded-proto

session cookie

EPSS

0.001

Percentile

40.4%

org.apache.tomcat:tomcat-catalina is vulnerable to Information Disclosure. The vulnerability is due to the setSecure function in RemoteIpFilter.java because http requests with the X-Forwarded-Proto header set to https do not include the secure attribute, which could result in an session cookie being transmitted over an insecure channel.

References

bz.apache.org/bugzilla/show_bug.cgi?id=66471

github.com/advisories/GHSA-2c9m-w27f-53rm

github.com/apache/tomcat/commit/3b51230764da595bb19e8d0962dd8c69ab40dfab

github.com/apache/tomcat/commit/5b72c94e8b2c4ada63a1d91dc527bf4d8fd1f510

github.com/apache/tomcat/commit/c64d496dda1560b5df113be55fbfaefec349b50f

github.com/apache/tomcat/commit/f509bbf31fc00abe3d9f25ebfabca5e05173da5b

lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67

tomcat.apache.org/security-10.html

tomcat.apache.org/security-11.html

tomcat.apache.org/security-8.html

tomcat.apache.org/security-9.html

EPSS

0.001

Percentile

40.4%

Related for VERACODE:39930

osv9 ibm17 tomcat4 cve1 nessus32 openvas10 ubuntucve1 debiancve1 f51 cvelist1 github1 kaspersky2 redhatcve1 nvd1 prion1 atlassian2 amazon2 photon2 debian2 redhat4 almalinux2 oraclelinux2 mageia1 rosalinux1 oracle4