Unprotected Transport of Credentials Affecting org.apache.tomcat:tomcat-catalina package, versions [8.5.0,8.5.86) [9.0.0-M1,9.0.72) [10.1.0-M1,10.1.6) [11.0.0-M1,11.0.0-M3)
Threat Intelligence
EPSS
0.09% (40th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHETOMCAT-3369685
- published 23 Mar 2023
- disclosed 22 Mar 2023
- credit Unknown
Introduced: 22 Mar 2023
CVE-2023-28708 Open this link in a new tabHow to fix?
Upgrade org.apache.tomcat:tomcat-catalina to version 8.5.86, 9.0.72, 10.1.6, 11.0.0-M3 or higher.
Overview
org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations.
Affected versions of this package are vulnerable to Unprotected Transport of Credentials when using the RemoteIpFilter with requests received from a reverse proxy via HTTP, in which the X-Forwarded-Proto header is set to https.
Session cookies do not include the secure attribute, so the user agent may transmit the session cookie over an insecure channel.
CVSS Scores
version 3.1