When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.
Older, EOL versions may also be affected.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-tomcatalma-upgrade-tomcat-admin-webappsalma-upgrade-tomcat-docs-webappalma-upgrade-tomcat-el-3.0-apialma-upgrade-tomcat-jsp-2.3-apialma-upgrade-tomcat-libalma-upgrade-tomcat-servlet-4.0-apialma-upgrade-tomcat-webapps | Nov 16, 2023 | Mar 22, 2023 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-tomcatamazon-linux-ami-2-upgrade-tomcat-admin-webappsamazon-linux-ami-2-upgrade-tomcat-docs-webappamazon-linux-ami-2-upgrade-tomcat-el-2-2-apiamazon-linux-ami-2-upgrade-tomcat-el-3-0-apiamazon-linux-ami-2-upgrade-tomcat-javadocamazon-linux-ami-2-upgrade-tomcat-jsp-2-2-apiamazon-linux-ami-2-upgrade-tomcat-jsp-2-3-apiamazon-linux-ami-2-upgrade-tomcat-jsvcamazon-linux-ami-2-upgrade-tomcat-libamazon-linux-ami-2-upgrade-tomcat-servlet-3-0-apiamazon-linux-ami-2-upgrade-tomcat-servlet-3-1-apiamazon-linux-ami-2-upgrade-tomcat-servlet-4-0-apiamazon-linux-ami-2-upgrade-tomcat-webapps | May 3, 2023 | Mar 22, 2023 | |
| Amazon_linux | — | amazon-linux-upgrade-tomcat8 | Apr 21, 2023 | Mar 22, 2023 |
| Apache Tomcat | apache-tomcat-upgrade-8_5_86apache-tomcat-upgrade-9_0_72apache-tomcat-upgrade-10_1_6apache-tomcat-upgrade-11_0_0apache-tomcat-10_1apache-tomcat-11_0apache-tomcat-8_5apache-tomcat-9_0apache-tomcat-upgrade-latest | Mar 23, 2023 | Mar 22, 2023 | |
| Centos_linux | — | centos-upgrade-tomcatcentos-upgrade-tomcat-admin-webappscentos-upgrade-tomcat-docs-webappcentos-upgrade-tomcat-el-3-0-apicentos-upgrade-tomcat-jsp-2-3-apicentos-upgrade-tomcat-libcentos-upgrade-tomcat-servlet-4-0-apicentos-upgrade-tomcat-webapps | Nov 8, 2023 | Mar 22, 2023 |
| Debian | debian-upgrade-tomcat10debian-upgrade-tomcat9 | Apr 10, 2023 | Mar 22, 2023 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-phphuawei-euleros-2_0_sp8-upgrade-php-clihuawei-euleros-2_0_sp8-upgrade-php-commonhuawei-euleros-2_0_sp8-upgrade-php-fpmhuawei-euleros-2_0_sp8-upgrade-php-gdhuawei-euleros-2_0_sp8-upgrade-php-ldaphuawei-euleros-2_0_sp8-upgrade-php-odbchuawei-euleros-2_0_sp8-upgrade-php-pdohuawei-euleros-2_0_sp8-upgrade-php-processhuawei-euleros-2_0_sp8-upgrade-php-recodehuawei-euleros-2_0_sp8-upgrade-php-soaphuawei-euleros-2_0_sp8-upgrade-php-xmlhuawei-euleros-2_0_sp8-upgrade-php-xmlrpc | Jun 9, 2023 | Mar 22, 2023 | |
| Oracle_linux | — | oracle-linux-upgrade-tomcatoracle-linux-upgrade-tomcat-admin-webappsoracle-linux-upgrade-tomcat-docs-webapporacle-linux-upgrade-tomcat-el-3-0-apioracle-linux-upgrade-tomcat-jsp-2-3-apioracle-linux-upgrade-tomcat-liboracle-linux-upgrade-tomcat-servlet-4-0-apioracle-linux-upgrade-tomcat-webapps | Nov 16, 2023 | Mar 22, 2023 |
| Redhat_linux | redhat-upgrade-tomcatredhat-upgrade-tomcat-admin-webappsredhat-upgrade-tomcat-docs-webappredhat-upgrade-tomcat-el-3-0-apiredhat-upgrade-tomcat-jsp-2-3-apiredhat-upgrade-tomcat-libredhat-upgrade-tomcat-servlet-4-0-apiredhat-upgrade-tomcat-webapps | Nov 8, 2023 | Mar 22, 2023 | |
| Suse | — | suse-upgrade-tomcatsuse-upgrade-tomcat-admin-webappssuse-upgrade-tomcat-docs-webappsuse-upgrade-tomcat-el-3_0-apisuse-upgrade-tomcat-embedsuse-upgrade-tomcat-javadocsuse-upgrade-tomcat-jsp-2_3-apisuse-upgrade-tomcat-jsvcsuse-upgrade-tomcat-libsuse-upgrade-tomcat-servlet-4_0-apisuse-upgrade-tomcat-webapps | Mar 30, 2023 | Mar 22, 2023 |
| Ubuntu | ubuntu-pro-upgrade-libtomcat10-javaubuntu-pro-upgrade-libtomcat8-javaubuntu-pro-upgrade-libtomcat9-javaubuntu-pro-upgrade-tomcat10ubuntu-pro-upgrade-tomcat8ubuntu-pro-upgrade-tomcat9ubuntu-upgrade-libtomcat9-javaubuntu-upgrade-tomcat9 | Nov 19, 2024 | Mar 22, 2023 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Mar 22, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub