CVE-2023-28708
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and…
Does this matter?
Lower severity and a low EPSS score (1.83%). Track it; it rarely justifies an emergency change on its own.
Description
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- EPSS
- 1.83% probability · 78th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-523
- Affected
- apache/tomcat
- Source
- security@apache.org
References
- https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67Mailing List, Patch, Vendor Advisory
- https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67Mailing List, Patch, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20230331-0012/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.