CVE-2010-4312
apache tomcat: no CVSS score yet. EPSS 2.1% chance of exploitation in the next 30 days. Fixed in org.apache.tomcat:tomcat 6.0.35.
The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.
- EPSS
- 2.1% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
- CWE
- CWE-16
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:tomcat
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-pvjh-7h8q-q56r | Maven | org.apache.tomcat:tomcat | >=6.0.0 <6.0.35 | 6.0.35 |