CVE-2023-28708 : When using the RemoteIpFilter with requests received from a reverse proxy via HT

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.

Published 2023-03-22 11:15:11

Updated 2023-03-27 15:26:52

Source Apache Software Foundation

View at NVD, CVE.org

Products affected by CVE-2023-28708

Apache » Tomcat
Versions after (>) 10.1.0 and before (<) 10.1.6
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat
Versions from including (>=) 8.5.0 and before (<) 8.5.86
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat
Versions after (>) 9.0.0 and before (<) 9.0.72
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 11.0.0 Update Milestone1
cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*
Matching versions
Apache » Tomcat » Version: 11.0.0 Update Milestone2
cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2023-28708

Top countries where our scanners detected CVE-2023-28708

Top open port discovered on systems with this issue 80

IPs affected by CVE-2023-28708 395,060

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2023-28708!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2023-28708

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 39 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-28708

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N	2.8	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
4.3	MEDIUM	AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N	N/A	N/A	Oracle:CPUOct2023
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2023-28708

CWE-523 Unprotected Transport of Credentials

Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

Assigned by: security@apache.org (Primary)

References for CVE-2023-28708

https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67

[SECURITY] CVE-2023-28708 Apache Tomcat - Information Disclosure-Apache Mail Archives
Mailing List;Patch;Vendor Advisory