What is CVE-2023-28708?

CVE-2023-28708 is a medium-severity vulnerability in Apache Tomcat, classified under Unprotected Transport of Credentials. CVSS score: 4.3/10. Published 2023-03-22.

How severe is CVE-2023-28708?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Is CVE-2023-28708 known to be exploited?

9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Apache Tomcat

CVE-2023-28708

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected.

EPSS: 0.018 (76.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N.

Affected products

Apache Tomcat — versions 11.0.0
Apache Software Foundation Tomcat — versions 11.0.0-M1, 10.1.0-M1, 9.0.0-M1

Weakness classification (CWE)

CWE-523 — Unprotected Transport of Credentials

Public proof-of-concept exploits

References

security@apache.org (vendor-advisory, Patch, Mailing List, Vendor Advisory)
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2023-28708?: CVE-2023-28708 is a medium-severity vulnerability in Apache Tomcat, classified under Unprotected Transport of Credentials. CVSS score: 4.3/10. Published 2023-03-22.
How severe is CVE-2023-28708?: Medium severity. CVSS v3 base score is 4.3 out of 10.
Is CVE-2023-28708 known to be exploited?: 9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.