Sensitive cookie in HTTPS session without Secure attribute in Apache Tomcat - CVE-2023-28708

Vulnerability identifier: #VU73957

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-28708

CWE-ID: CWE-614

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to Apache Tomcat does not set the "Secure" attribute for the JSESSIONID session cookie when using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https. A remote attacker can force the application to transmit cookie via an insecure channel and intercept it.

Apache Tomcat
JBoss Web Server
Amazon Linux AMI
Oracle Linux
Debian Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
Oracle Solaris
SUSE Linux Enterprise Server 12 SP4 ESPOS
SUSE Linux Enterprise Server 12 SP4 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Web and Scripting Module
openSUSE Leap
Ubuntu
openEuler
IBM Data Risk Manager
Oracle Utilities Testing Accelerator
Oracle Financial Services Crime and Compliance Management Studio
Oracle Managed File Transfer
Oracle Banking Supply Chain Finance
Oracle Banking Cash Management
SecureTransport
Dell Policy Manager for Secure Connect Gateway (SCG)
webMethods developer portal
Oracle Communications Policy Management
Oracle Siebel CRM
Storage Copy Data Management
Cloud Pak for Network Automation
IBM Watson Machine Learning Accelerator
UrbanCode Build
CloudBoost Virtual Appliance
Dell Secure Connect Gateway
IBM Rational Build Forge
Oracle Communications Diameter Signaling Router
Oracle SD-WAN Edge
Oracle Communications Cloud Native Core Binding Support Function
IBM Process Mining
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Sterling Control Center
IBM UrbanCode Release
IBM Maximo Application Suite
IBM InfoSphere Information Server for Cloud
NetWorker
IBM App Connect Professional
Oracle Agile PLM Framework
Oracle Communications Cloud Native Core Policy
Tomcat
jws5-tomcat-native (Red Hat package)
tomcat10 (Ubuntu package)
tomcat8
tomcat
tomcat-help
tomcat-jsvc
tomcat-webapps
tomcat-admin-webapps
tomcat-el-3_0-api
tomcat-lib
tomcat-jsp-2_3-api
tomcat-servlet-4_0-api
tomcat-docs-webapp
tomcat-javadoc
tomcat9 (Debian package)
tomcat-embed
jws5-tomcat (Red Hat package)
tomcat (Red Hat package)
tomcat-el-3.0-api
tomcat-jsp-2.3-api
tomcat-servlet-4.0-api
tomcat9
Cloud Pak for Security (CP4S)
IBM Qradar SIEM
Dell EMC Storage Monitoring and Reporting (SMR)
EMC ViPR SRM
RecoverPoint for VMs
Operational Decision Manager
IBM InfoSphere Information Server

Install updates from vendor's website.

Apache Tomcat - addressed in versions 8.5.86, 9.0.72, 10.1.6, 11.0.0-M3
IBM Data Risk Manager - update to 2.0.6.17
SecureTransport - update to 5.5-20230427
JBoss Web Server - update to 5.7.4
Dell Policy Manager for Secure Connect Gateway (SCG) - update to 5.16.00.14
Dell Secure Connect Gateway - update to 5.16
IBM Rational Build Forge - update to 8.0.0.24
webMethods developer portal - update to 11.1.6
Oracle Siebel CRM - update to 23.5
Tomcat - update to D.9.0.87.01
jws5-tomcat-native (Red Hat package) - addressed in versions 1.2.31-15.redhat_15.el7jws, 1.2.31-15.redhat_15.el8jws, 1.2.31-15.redhat_15.el9jws
Cloud Pak for Security (CP4S) - update to 1.10.14.0
IBM Process Mining - update to 1.14.1
Storage Copy Data Management - update to 2.2.23.0
Cloud Pak for Network Automation - update to 2.4.6
IBM Watson Machine Learning Accelerator - update to 4.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.0
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.7
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 4.7
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.9.0.0
EMC ViPR SRM - update to 4.9.0.0
RecoverPoint for VMs - update to 6.0.SP1.P1
UrbanCode Build - update to 6.1.7.9
IBM Sterling Control Center - update to 6.2.1.0.14
IBM UrbanCode Release - update to 6.2.5.11
IBM Qradar SIEM - update to 7.5.0 Update Pack 6
tomcat10 (Ubuntu package) - addressed in versions 8.5.39-1ubuntu1~18.04.3+esm5, 9.0.16-3ubuntu0.18.04.2+esm7, 9.0.31-1ubuntu0.9+esm2, 9.0.58-1ubuntu0.2+esm3, 9.0.70-2ubuntu0.1+esm2, 9.0.70-2ubuntu1.24.10.2, 9.0.70-2ubuntu1.25.04.2, 10.1.16-1ubuntu0.1~esm2
tomcat8 - update to 8.5.87-1.92
IBM Maximo Application Suite - addressed in versions 8.9.6, 8.10.4
Operational Decision Manager - addressed in versions 8.10.5.1 Interim fix 38, 8.11.0.1 Interim fix 20, 8.11.1 Interim fix 8
tomcat - update to 9.0.10-28
tomcat-help - update to 9.0.10-28
tomcat-jsvc - update to 9.0.10-28
tomcat-webapps - addressed in versions 9.0.36-3.102.1, 9.0.36-150100.4.90.1, 9.0.43-150200.35.1
tomcat-admin-webapps - addressed in versions 9.0.36-3.102.1, 9.0.36-150100.4.90.1, 9.0.43-150200.35.1
tomcat-el-3_0-api - addressed in versions 9.0.36-3.102.1, 9.0.36-150100.4.90.1, 9.0.43-150200.35.1
tomcat - addressed in versions 9.0.36-3.102.1, 9.0.36-150100.4.90.1, 9.0.43-150200.35.1
tomcat-lib - addressed in versions 9.0.36-3.102.1, 9.0.36-150100.4.90.1, 9.0.43-150200.35.1
tomcat-jsp-2_3-api - addressed in versions 9.0.36-3.102.1, 9.0.36-150100.4.90.1, 9.0.43-150200.35.1
tomcat-servlet-4_0-api - addressed in versions 9.0.36-3.102.1, 9.0.36-150100.4.90.1, 9.0.43-150200.35.1
tomcat-docs-webapp - addressed in versions 9.0.36-3.102.1, 9.0.43-150200.35.1
tomcat-javadoc - addressed in versions 9.0.36-3.102.1, 9.0.43-150200.35.1
tomcat9 (Debian package) - update to 9.0.43-2~deb11u6
tomcat-jsvc - update to 9.0.43-150200.35.1
tomcat-embed - update to 9.0.43-150200.35.1
jws5-tomcat (Red Hat package) - addressed in versions 9.0.62-15.redhat_00013.1.el7jws, 9.0.62-15.redhat_00013.1.el8jws, 9.0.62-15.redhat_00013.1.el9jws
tomcat (Red Hat package) - addressed in versions 9.0.62-27.el8_9, 9.0.62-37.el9_3
tomcat-webapps - update to 9.0.62-30
tomcat - update to 9.0.62-30
tomcat-admin-webapps - update to 9.0.62-30
tomcat-docs-webapp - update to 9.0.62-30
tomcat-el-3.0-api - update to 9.0.62-30
tomcat-jsp-2.3-api - update to 9.0.62-30
tomcat-lib - update to 9.0.62-30
tomcat-servlet-4.0-api - update to 9.0.62-30
tomcat9 - update to 9.0.71-1
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1
IBM InfoSphere Information Server for Cloud - update to 11.7.1.4 Service pack 1
NetWorker - update to 19.9.0.2
CloudBoost Virtual Appliance - update to 19.12.0.1

• https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67

• Insecure cookie configuration in Apache Tomcat
• SUSE update for tomcat
• SUSE update for tomcat
• SUSE update for tomcat
• Debian update for tomcat9
• Sensitive cookie in HTTPS session without secure attribute in App Connect Professional
• Sensitive cookie in HTTPS session without Secure attribute in Oracle Financial Services Crime and Compliance Management Studio
• Multiple vulnerabilities in Oracle Communications Policy Management
• Multiple vulnerabilities in Oracle Solaris third-party software
• Amazon Linux AMI update for tomcat8
• Multiple vulnerabilities in Axway SecureTransport
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in IBM Data Risk Manager
• Multiple vulnerabilities in IBM Operational Decision Manager
• IBM Process Mining update for Apache Tomcat
• Sensitive cookie in HTTPS session without Secure attribute in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Sensitive cookie in HTTPS session without Secure attribute in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM QRadar SIEM
• Sensitive cookie in HTTPS session without Secure attribute in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Sensitive cookie in HTTPS session without Secure attribute in IBM InfoSphere Information Server
• Multiple vulnerabilities in Oracle SD-WAN Edge
• Multiple vulnerabilities in Oracle Communications Diameter Signaling Router
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in Oracle Agile PLM Framework
• Multiple vulnerabilities in Oracle Siebel CRM
• Multiple vulnerabilities in IBM Watson Knowledge Catalog for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Maximo Application Suite - Monitor Component
• Multiple vulnerabilities in Dell Secure Connect Gateway Security Policy Manager
• Multiple vulnerabilities in Dell EMC SRM and Dell EMC Storage Monitoring and Reporting (SMR)
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Multiple vulnerabilities in Red Hat JBoss Web Server 5.7
• Multiple vulnerabilities in JBoss Enterprise Web Server 5 for RHEL 8
• Sensitive cookie in HTTPS session without Secure attribute in IBM UrbanCode Build
• Multiple vulnerabilities in Dell NetWorker
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Sensitive cookie in HTTPS session without Secure attribute in Oracle Managed File Transfer
• Multiple vulnerabilities in IBM UrbanCode Release
• Multiple vulnerabilities in IBM Rational Build Forge
• Red Hat Enterprise Linux 9 update for tomcat
• Multiple vulnerabilities in Oracle Linux
• Red Hat Enterprise Linux 8 update for tomcat
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• openEuler update for tomcat
• Multiple vulnerabilities in IBM Storage Copy Data Management
• Amazon Linux AMI update for tomcat9
• HP-UX update for Tomcat
• Multiple vulnerabilities in IBM Control Center
• Multiple vulnerabilities in Dell RecoverPoint for Virtual Machines
• Anolis OS update for tomcat
• Dell CloudBoost Virtual Appliance update for third-party components
• Ubuntu update for tomcat10
• Multiple vulnerabilities in IBM webMethods developer portal
• Multiple vulnerabilities in Oracle Utilities Testing Accelerator
• Multiple vulnerabilities in Oracle Banking Supply Chain Finance
• Multiple vulnerabilities in Oracle Banking Cash Management