Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 11.0.0-M3, 10.1.6, 9.0.72, 8.5.86
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Apache Software Foundation Apache Tomcat
From 11.0.0-M1 · through 11.0.0-M2; From 10.1.0-M1 · through 10.1.5; From 9.0.0-M1 · through 9.0.71; From 8.5.0 · through 8.5.85
- org.apache.tomcat:tomcat-catalinaMaven
From 11.0.0-M1 · fixed in 11.0.0-M3
- org.apache.tomcat:tomcat-catalinaMaven
From 10.1.0-M1 · fixed in 10.1.6
- org.apache.tomcat:tomcat-catalinaMaven
From 9.0.0-M1 · fixed in 9.0.72
- org.apache.tomcat:tomcat-catalinaMaven
From 8.5.0 · fixed in 8.5.86