CVE-2023-28708
Medium
Description
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected.
SeverityMedium
CVSS4.3
Exploit probability—
Product
Apache Tomcat
PublishedMar 22, 2023
First seenMar 22, 2023
Weakness typeCWE-523CWE-523
How to fix
Update
- apache tomcat8.5.86, 9.0.72, 10.1.6 or later
- org.apache.tomcat:tomcat-catalina11.0.0-M3, 10.1.6, 9.0.72, 8.5.86 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache tomcat | 8.5.0 ≤ v < 8.5.86, 9.0.0 < v < 9.0.72, 10.1.0 < v < 10.1.6, 11.0.0 | 8.5.86, 9.0.72, 10.1.6 |
| org.apache.tomcat:tomcat-catalinaMaven | 11.0.0-M1 ≤ v < 11.0.0-M3, 10.1.0-M1 ≤ v < 10.1.6, 9.0.0-M1 ≤ v < 9.0.72, 8.5.0 ≤ v < 8.5.86 | 11.0.0-M3, 10.1.6, 9.0.72, 8.5.86 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.