Vulnerability Description
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Tomcat | >= 8.5.0, < 8.5.86 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67Mailing ListPatchVendor Advisory
- https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67Mailing ListPatchVendor Advisory
- https://security.netapp.com/advisory/ntap-20230331-0012/
FAQ
What is CVE-2023-28708?
CVE-2023-28708 is a vulnerability with a CVSS score of 4.3 (MEDIUM). When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 1...
How severe is CVE-2023-28708?
CVE-2023-28708 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-28708?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Tomcat.