When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.
Older, EOL versions may also be affected.
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67 | Mailing List Patch Vendor Advisory |
| https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67 | Mailing List Patch Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20230331-0012/ |
Configurations
Configuration 1 (hide)
|
History
04 Nov 2025, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 Aug 2025, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected. |
Information
Published : 2023-03-22 11:15
Updated : 2025-11-04 20:16
NVD link : CVE-2023-28708
Mitre link : CVE-2023-28708
CVE.ORG link : CVE-2023-28708
JSON object : View
Products Affected
apache
- tomcat
CWE
CWE-523
Unprotected Transport of Credentials