CVE-2023-28708 Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations
Attackers can intercept session cookies transmitted over insecure channels when using RemoteIpFilter with specific reverse proxy configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-28708?
CVE-2023-28708 is a medium-severity vulnerability in Apache Tomcat, published on 22 Mar 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.
Older, EOL versions may also be affected.
Weakness: CWE-523
Which versions are affected by CVE-2023-28708?
9 open source packages ship an affected version, including org.apache.tomcat:tomcat-catalina and tomcat. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat:tomcat-catalina Maven | From 10.1.0-M1 | 10.1.6 |
org.apache.tomcat:tomcat-catalina Maven | From 10.1.0-M1 | 10.1.6 |
org.apache.tomcat:tomcat-catalina Maven | From 11.0.0-M1 | 11.0.0-M3 |
org.apache.tomcat:tomcat-catalina Maven | From 11.0.0-M1 | 11.0.0-M3 |
org.apache.tomcat:tomcat-catalina Maven | From 8.5.0 | 8.5.86 |
org.apache.tomcat:tomcat-catalina Maven | From 8.5.0 | 8.5.86 |
3 more packages
org.apache.tomcat:tomcat-catalina Maven | From 9.0.0-M1 | 9.0.72 |
org.apache.tomcat:tomcat-catalina Maven | From 9.0.0-M1 | 9.0.72 |
tomcat Bitnami | From 8.5.0 | 8.5.86, 9.0.72, 10.1.6 |
Linux distribution packages (11)
tomcat SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 9.0.36-150100.4.90.1 |
tomcat SUSE:Linux Enterprise Server 12 SP4-ESPOS | All versions | 9.0.36-3.102.1 |
tomcat SUSE:Linux Enterprise Server 12 SP4-LTSS | All versions | 9.0.36-3.102.1 |
tomcat SUSE:Linux Enterprise Server 12 SP5 | All versions | 9.0.36-3.102.1 |
tomcat SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 9.0.36-150100.4.90.1 |
tomcat SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 9.0.36-3.102.1 |
tomcat SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 9.0.36-3.102.1 |
tomcat SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | All versions | 9.0.36-150100.4.90.1 |
tomcat SUSE:OpenStack Cloud 9 | All versions | 9.0.36-3.102.1 |
tomcat SUSE:OpenStack Cloud Crowbar 9 | All versions | 9.0.36-3.102.1 |
tomcat openSUSE:Tumbleweed | All versions | 9.0.43-15.1 |
Products include Apache Tomcat.
How do I fix CVE-2023-28708?
Upgrade org.apache.tomcat:tomcat-catalina to a fixed version for your release line: 10.1.6, 11.0.0-M3, 8.5.86 or 9.0.72.
Is CVE-2023-28708 being exploited?
There is no known exploitation of CVE-2023-28708 in the wild and no public exploit code.
Other vulnerabilities in Apache Tomcat
Sources
Also known as BIT-tomcat-2023-28708, CLEANSTART-2026-RF65873, CLSA-2024-1735064733, CLSA-2024-1735065713, CLSA-2026-1793132890, DEBIAN-CVE-2023-28708 and 6 more.