CVE-2023-28708

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.
References
Link Resource
https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67 Mailing List Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*

History

07 Nov 2023, 04:10

Type Values Removed Values Added
Summary When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.

27 Mar 2023, 15:26

Type Values Removed Values Added
CPE cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 4.3
First Time Apache
Apache tomcat
References (MISC) https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67 - (MISC) https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67 - Mailing List, Patch, Vendor Advisory

22 Mar 2023, 11:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-03-22 11:15

Updated : 2023-12-10 15:01


NVD link : CVE-2023-28708

Mitre link : CVE-2023-28708

CVE.ORG link : CVE-2023-28708


JSON object : View

Products Affected

apache

  • tomcat
CWE
CWE-523

Unprotected Transport of Credentials