Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2023-28708

Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Tomcat

Default version status: unaffected

  • 11.0.0-M1 to ≤ 11.0.0-M2affected
  • 10.1.0-M1 to ≤ 10.1.5affected
  • 9.0.0-M1 to ≤ 9.0.71affected
  • 8.5.0 to ≤ 8.5.85affected
  • 3 to < 8.5.0unknown
  • 10.0.0-M1 to ≤ 10.0.27unknown

References