UpHeron
All vulnerabilities

Servers and applications

CVE-2023-28708

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.…

Severity
Medium 4.3
Published
22 Mar 2023
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
8.5.86, 9.0.72, 10.1.6
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • From 8.5.0 before 8.5.86
  • After 9.0.0 before 9.0.72
  • After 10.1.0 before 10.1.6
  • Version 11.0.0-milestone1
  • Version 11.0.0-milestone2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-28708
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-28708