CVE-2023-28708 — Unprotected Transport of Credentials in Apache Tomcat

CWE-523 — Unprotected Transport of CredentialsCWE-200 — Sensitive Information Exposure15 documents9 sources
Severity
4.3MEDIUMNVD
EPSS
0.1%
top 72.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache TomcatApache Software Foundation Apache Tomcat
Timeline
PublishedMar 22
Latest updateJun 9

Description

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶NVDapache/tomcat8.5.0 — 8.5.86+3
▶CVEListV5apache_software_foundation/apache_tomcat11.0.0-M1 — 11.0.0-M2+3

Patches

Patch: lists.apache.org ↗Patch: lists.apache.org ↗

🔴Vulnerability Details

6
OSV
tomcat vulnerabilities↗2025-06-09
▶
OSV
tomcat9 vulnerabilities↗2024-11-13
▶
OSV
CVE-2023-28708: When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session coo↗2023-03-22
▶
CVEList
Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations↗2023-03-22
▶
OSV
Apache Tomcat vulnerable to Unprotected Transport of Credentials↗2023-03-22
▶

📋Vendor Advisories

8
Ubuntu
Tomcat vulnerabilities↗2025-06-09
▶
Ubuntu
Tomcat vulnerabilities↗2024-11-13
▶
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: MFT Runtime Server (Apache Tomcat) — CVE-2023-28708↗2023-10-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: Install/Upgrade (Apache Tomcat) — CVE-2023-28708↗2023-07-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: Core (Apache Tomcat) — CVE-2023-28708↗2023-04-15
▶
CVE-2023-28708 — Unprotected Transport of Credentials | cvebase