GHSA-2c9m-w27f-53rm BIT-tomcat-2023-28708 CVE-2023-28708
Apache Tomcat vulnerable to Unprotected Transport of Credentials
- Severity
- 4.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 1.83%
- Chance of exploitation in the next 30 days. Higher than 78.88% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-523 Unprotected Transport of Credentials
- Fix
11.0.0-M3- Upgrade org.apache.tomcat:tomcat-catalina to this version or later
Description
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.apache.tomcat:tomcat-catalina | >= 11.0.0-M1, < 11.0.0-M3 |
11.0.0-M3 |
| org.apache.tomcat:tomcat-catalina | >= 10.1.0-M1, < 10.1.6 |
10.1.6 |
| org.apache.tomcat:tomcat-catalina | >= 9.0.0-M1, < 9.0.72 |
9.0.72 |
| org.apache.tomcat:tomcat-catalina | >= 8.5.0, < 8.5.86 |
8.5.86 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.apache.tomcat:tomcat-catalina Maven → 11.0.0-M3
- maven
<dependency><groupId>org.apache.tomcat</groupId><artifactId>tomcat-catalina</artifactId><version>11.0.0-M3</version></dependency>- gradle
implementation("org.apache.tomcat:tomcat-catalina:11.0.0-M3")
Severity breakdown
CVSS 3.1 4.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Weakness
CWE-523: Unprotected Transport of Credentials
Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.
How to prevent it
- Operation, System Configuration: Enforce SSL use for the login page or any page used to transmit user credentials or other sensitive information. Even if the entire site does not use SSL, it MUST use SSL for login. Additionally, to help prevent phishing attacks, make sure that SSL serves the login page. SSL allows the user to verify the identity of the server to which they are connecting. If the SSL serves login page, the user can be certain they are talking to the proper end system. A phishing attack would typically redirect a user to a site that does not have a valid trusted server certificate issued from an authorized supplier.
References
Advisories
Packages
Other links
- github.com/apache/tomcat/commit/3b51230764da595bb19e8d0962dd8c69ab40dfab
- github.com/apache/tomcat/commit/5b72c94e8b2c4ada63a1d91dc527bf4d8fd1f510
- github.com/apache/tomcat/commit/c64d496dda1560b5df113be55fbfaefec349b50f
- github.com/apache/tomcat/commit/f509bbf31fc00abe3d9f25ebfabca5e05173da5b
- bz.apache.org/bugzilla/show_bug.cgi
- lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67
- security.netapp.com/advisory/ntap-20230331-0012
- tomcat.apache.org/security-10.html
- tomcat.apache.org/security-11.html
- tomcat.apache.org/security-8.html
- tomcat.apache.org/security-9.html
- security.netapp.com/advisory/ntap-20230331-0012
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-83qj-6fr2-vhqg Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT | Critical Known exploited | Also affects org.apache.tomcat:tomcat-catalina |
| GHSA-xjgh-84hx-56c5 Unrestricted Upload of File with Dangerous Type Apache Tomcat | High Known exploited | Also affects org.apache.tomcat:tomcat-catalina |
| GHSA-cw54-59pw-4g8c Apache Tomcat Improper Access Control vulnerability | Critical Known exploited | Also affects org.apache.tomcat:tomcat-catalina |
| GHSA-h3x4-894j-xpx5 Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability | Critical | Also affects org.apache.tomcat:tomcat-catalina |
| GHSA-9xv2-5v5q-p794 Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability | Critical | Also affects org.apache.tomcat:tomcat-catalina |
| GHSA-gcx9-497g-6cp6 Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability | Critical | Also affects org.apache.tomcat:tomcat-catalina |
| GHSA-5m62-pw8w-7w9f Apache Tomcat - Security constraints not correctly applied | Critical | Also affects org.apache.tomcat:tomcat-catalina |
| GHSA-9m89-8frq-c98c Apache Tomcat - AJP secret compared in non-constant time | Low | Also affects org.apache.tomcat:tomcat-catalina |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor