When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.
Older, EOL versions may also be affected.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tomcat-jsp-2.3-apiUpgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-docs-webappUpgrade tomcat-servlet-4.0-apiUpgrade tomcatUpgrade tomcat-el-3.0-api | Nov 16, 2023 | Mar 22, 2023 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-el-2.2-apiUpgrade tomcat-docs-webappUpgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcat-servlet-3.1-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-javadocUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsvc | May 3, 2023 | Mar 22, 2023 |
| Amazon_linux | — | Upgrade tomcat8 | Apr 21, 2023 | Mar 22, 2023 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.5.86Upgrade Apache Tomcat to 9.0.72Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 11.0.0Upgrade Apache Tomcat to 10.1.6 | Mar 23, 2023 | Mar 22, 2023 |
| Centos_linux | — | Upgrade tomcat-webappsUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-el-3.0-apiUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.3-api | Nov 8, 2023 | Mar 22, 2023 |
| Debian | — | Upgrade tomcat9Upgrade tomcat10 | Apr 10, 2023 | Mar 22, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade php-xmlrpcUpgrade php-fpmUpgrade php-xmlUpgrade php-cliUpgrade php-ldapUpgrade phpUpgrade php-gdUpgrade php-recodeUpgrade php-odbcUpgrade php-pdoUpgrade php-processUpgrade php-soapUpgrade php-common | Jun 9, 2023 | Mar 22, 2023 |
| Oracle_linux | — | Upgrade tomcat-servlet-4.0-apiUpgrade tomcatUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-docs-webappUpgrade tomcat-el-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-lib | Nov 16, 2023 | Mar 22, 2023 |
| Redhat_linux | — | No solution existsUpgrade tomcat-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-docs-webappUpgrade tomcat | Nov 8, 2023 | Mar 22, 2023 |
| Suse | — | Upgrade tomcat-javadocUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-libUpgrade tomcat-jsvcUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-embedUpgrade tomcat-docs-webappUpgrade tomcat-el-3_0-apiUpgrade tomcat | Mar 30, 2023 | Mar 22, 2023 |
| Ubuntu | — | Upgrade tomcat8 (Ubuntu Pro)Upgrade tomcat9Upgrade libtomcat9-java (Ubuntu Pro)Upgrade tomcat9 (Ubuntu Pro)Upgrade libtomcat9-javaUpgrade tomcat10 (Ubuntu Pro)Upgrade libtomcat10-java (Ubuntu Pro)Upgrade libtomcat8-java (Ubuntu Pro) | Nov 19, 2024 | Mar 22, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 22, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub