cve.bz

CVE-2023-28708

4.3 mediumEPSS 1.8%

Medium (4.3) in apache tomcat. EPSS 1.8% chance of exploitation in the next 30 days. Fixed in org.apache.tomcat:tomcat-catalina 10.1.6, 11.0.0-M3, 8.5.86.

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected.

Severity

CVSS 3.1

4.3 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
EPSS
1.8% chance of exploitation in the next 30 days; higher than 78% of CVEs (scores of 2026-10-31)
CWE
CWE-523
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-2c9m-w27f-53rmMavenorg.apache.tomcat:tomcat-catalina>=11.0.0-M1 <11.0.0-M311.0.0-M3
GHSA-2c9m-w27f-53rmMavenorg.apache.tomcat:tomcat-catalina>=10.1.0-M1 <10.1.610.1.6
GHSA-2c9m-w27f-53rmMavenorg.apache.tomcat:tomcat-catalina>=9.0.0-M1 <9.0.729.0.72
GHSA-2c9m-w27f-53rmMavenorg.apache.tomcat:tomcat-catalina>=8.5.0 <8.5.868.5.86

References

Check your stackJSON