CVE-2023-28708CWE-523

Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations

Medium · published March 22, 2023

CVSS v3.1
4.3
EPSS
2%
Percentile
78.7
In the wild
Unconfirmed
What it is

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.

Older, EOL versions may also be affected.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01831 · 78.7th percentile
Weakness
CWE-523 · Unprotected Transport of Credentials
Published
2023-03-22T10:10Z
EPSS history
Timeline
  • 22 MAR 10:10Z
    Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations
    cvelistv5