Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations
Priority LOW 24CWE-523Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 7 fixed, 5 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.
Summary
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01831 79th percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat-catalina (Maven): 11.0.0-M3, 10.1.6, 9.0.72 +1Red Hat: 5 advisoriesRed Hat: 7 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Tomcat | 11.0.0-M1 – 11.0.0-M2; 10.1.0-M1 – 10.1.5; 9.0.0-M1 – 9.0.71; 8.5.0 – 8.5.85 | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat-catalina (Maven) | 11.0.0-M1 to before 11.0.0-M3 | 11.0.0-M3 | Patch available | GHSA-2c9m-w27f-53rm |
| — | org.apache.tomcat:tomcat-catalina (Maven) | 10.1.0-M1 to before 10.1.6 | 10.1.6 | Patch available | GHSA-2c9m-w27f-53rm |
| — | org.apache.tomcat:tomcat-catalina (Maven) | 9.0.0-M1 to before 9.0.72 | 9.0.72 | Patch available | GHSA-2c9m-w27f-53rm |
| — | org.apache.tomcat:tomcat-catalina (Maven) | 8.5.0 to before 8.5.86 | 8.5.86 | Patch available | GHSA-2c9m-w27f-53rm |
- Apache Tomcat VendorApache Affected 11.0.0-M1 – 11.0.0-M2; 10.1.0-M1 – 10.1.5; 9.0.0-M1 – 9.0.71; 8.5.0 – 8.5.85 Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 11.0.0-M1 to before 11.0.0-M3 Fixed in 11.0.0-M3 Patch available GHSA-2c9m-w27f-53rm
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 10.1.0-M1 to before 10.1.6 Fixed in 10.1.6 Patch available GHSA-2c9m-w27f-53rm
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 9.0.0-M1 to before 9.0.72 Fixed in 9.0.72 Patch available GHSA-2c9m-w27f-53rm
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 8.5.0 to before 8.5.86 Fixed in 8.5.86 Patch available GHSA-2c9m-w27f-53rm
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | 8.5.0 to before 8.5.86; after 9.0.0, before 9.0.72; after 10.1.0, before 10.1.6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:* | 11.0.0 milestone1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:* | 11.0.0 milestone2 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 8.5.0 to before 8.5.86; after 9.0.0, before 9.0.72; after 10.1.0, before 10.1.6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:* Versions 11.0.0 milestone1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:* Versions 11.0.0 milestone2 Vulnerable ·Apache
Remediation
- Fix · GHSA-2c9m-w27f-53rm org.apache.tomcat:tomcat-catalina (Maven) Fixed in 11.0.0-M3 Advisory →
- Fix · GHSA-2c9m-w27f-53rm org.apache.tomcat:tomcat-catalina (Maven) Fixed in 10.1.6 Advisory →
- Fix · GHSA-2c9m-w27f-53rm org.apache.tomcat:tomcat-catalina (Maven) Fixed in 9.0.72 Advisory →
- Fix · GHSA-2c9m-w27f-53rm org.apache.tomcat:tomcat-catalina (Maven) Fixed in 8.5.86 Advisory →
Red Hat 5 advisories
- RHSA-2024:3814 Released 2024-06-11 · Red Hat rating Importanttomcat security and bug fix update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) tomcat-1:9.0.87-1.el8_8.2, tomcat-admin-webapps-1:9.0.87-1.el8_8.2, tomcat-docs-webapp-1:9.0.87-1.el8_8.2 +5
- RHSA-2023:7065 Released 2023-11-14 · Red Hat rating Moderatetomcat security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) tomcat-1:9.0.62-27.el8_9, tomcat-admin-webapps-1:9.0.62-27.el8_9, tomcat-docs-webapp-1:9.0.62-27.el8_9 +5
- RHSA-2023:6570 Released 2023-11-07 · Red Hat rating Moderatetomcat security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) tomcat-1:9.0.62-37.el9_3, tomcat-admin-webapps-1:9.0.62-37.el9_3, tomcat-docs-webapp-1:9.0.62-37.el9_3 +5
Show 2 more Red Hat advisories
- RHSA-2023:4910 Released 2023-09-04 · Red Hat rating ModerateRed Hat JBoss Web Server 5.7.4 release and security update
- JWS 5.7.4 release
- RHSA-2023:4909 Released 2023-09-04 · Red Hat rating ModerateRed Hat JBoss Web Server 5.7.4 release and security update
- Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat-9.0.62-15.redhat_00013.1.el7jws, jws5-tomcat-admin-webapps-9.0.62-15.redhat_00013.1.el7jws, jws5-tomcat-docs-webapp-9.0.62-15.redhat_00013.1.el7jws +10
- Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat-9.0.62-15.redhat_00013.1.el8jws, jws5-tomcat-admin-webapps-9.0.62-15.redhat_00013.1.el8jws, jws5-tomcat-docs-webapp-9.0.62-15.redhat_00013.1.el8jws +8
- Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-tomcat-9.0.62-15.redhat_00013.1.el9jws, jws5-tomcat-admin-webapps-9.0.62-15.redhat_00013.1.el9jws, jws5-tomcat-docs-webapp-9.0.62-15.redhat_00013.1.el9jws +8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat JBoss Web Server 3 | Affected | No fix planned: Will not fix |
| JWS 5.7.4 release | Fixed | RHSA-2023:4910 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:7065 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:6570 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2024:3814 |
| Red Hat JBoss Web Server 5.7 for RHEL 7 Server | Fixed | RHSA-2023:4909 |
| Red Hat JBoss Web Server 5.7 for RHEL 8 | Fixed | RHSA-2023:4909 |
| Red Hat JBoss Web Server 5.7 for RHEL 9 | Fixed | RHSA-2023:4909 |
Not affected: 3 products
- Red Hat JBoss Web Server 5.7 for RHEL 7 Server
- Red Hat JBoss Web Server 5.7 for RHEL 8
- Red Hat JBoss Web Server 5.7 for RHEL 9
Timeline
- 2026-10-02 Threatist record created from CVE-2023-28708
- 2026-10-03 Alias added: GHSA-2c9m-w27f-53rm
References
Other 11
- https://github.com/apache/tomcat/commit/3b51230764da595bb19e8d0962dd8c69ab40dfab
- https://github.com/apache/tomcat/commit/5b72c94e8b2c4ada63a1d91dc527bf4d8fd1f510
- https://github.com/apache/tomcat/commit/c64d496dda1560b5df113be55fbfaefec349b50f
- https://github.com/apache/tomcat/commit/f509bbf31fc00abe3d9f25ebfabca5e05173da5b
- https://bz.apache.org/bugzilla/show_bug.cgi?id=66471
- https://github.com/apache/tomcat
- https://security.netapp.com/advisory/ntap-20230331-0012
- https://tomcat.apache.org/security-10.html
- https://tomcat.apache.org/security-11.html
- https://tomcat.apache.org/security-8.html
- https://tomcat.apache.org/security-9.html
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2023-28708 · CVE Program
- CVE-2023-28708 · NVD
- FIRST EPSS
- GHSA-2c9m-w27f-53rm · GitHub Advisory Database · CC BY 4.0
- CVE-2023-28708 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences