Vulnerability in Apache Tomcat
CVE-2023-28708
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.018 (78.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 79th percentile — 78.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.018 · newest: 0.018 · change: 0.000
Affected products
- Apache Tomcat — versions 11.0.0
- Apache Software Foundation Tomcat — versions 11.0.0-M1, 10.1.0-M1, 9.0.0-M1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67 (vendor-advisory, Patch, Mailing List, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2023-28708?
- CVE-2023-28708 is a medium-severity vulnerability in Apache Tomcat, classified under Unprotected Transport of Credentials. CVSS score: 4.3/10. Published 2023-03-22.
- How severe is CVE-2023-28708?
- Medium severity. CVSS v3 base score is 4.3 out of 10.
- Is CVE-2023-28708 known to be exploited?
- 9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.