Unprotected Transport of Credentials Affecting org.apache.tomcat.embed:tomcat-embed-core package, versions [8.5.0,8.5.86) [9.0.0-M1,9.0.72) [10.1.0-M1,10.1.6) [11.0.0-M1,11.0.0-M3)
Threat Intelligence
EPSS
0.09% (41st
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHETOMCATEMBED-3369687
- published 23 Mar 2023
- disclosed 22 Mar 2023
- credit Unknown
Introduced: 22 Mar 2023
CVE-2023-28708 Open this link in a new tabHow to fix?
Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 8.5.86, 9.0.72, 10.1.6, 11.0.0-M3 or higher.
Overview
org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.
Affected versions of this package are vulnerable to Unprotected Transport of Credentials when using the RemoteIpFilter with requests received from a reverse proxy via HTTP, in which the X-Forwarded-Proto header is set to https.
Session cookies do not include the secure attribute, so the user agent may transmit the session cookie over an insecure channel.
CVSS Scores
version 3.1