CVE-2023-28708

Published: Mar 22, 2023Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected.

Affected (5)

Products: Apache: Tomcat

Apache

1 product

Tomcat

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	After 10.1.0 to 10.1.6
Apache Tomcat	After 9.0.0 to 9.0.72
Apache Tomcat	From 8.5.0 to 8.5.86
Apache Tomcat	Version 11.0.0 milestone1
Apache Tomcat	Version 11.0.0 milestone2

Related CWEs

CWE-523

Unprotected Transport of Credentials

Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

References (3)

https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67

Source: security@apache.org

Mailing ListPatchVendor Advisory

https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchVendor Advisory

https://security.netapp.com/advisory/ntap-20230331-0012/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.