CVE-2023-28708: Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-22 · updated 2026-06-17
Weakness: CWE-523

Description

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected.

Affected products

Apache Tomcat: from 8.5.0 before 8.5.86; from 9.0.0 (excl.) before 9.0.72; from 10.1.0 (excl.) before 10.1.6; 11.0.0-milestone1, 11.0.0-milestone2 — fixed in 10.1.6, 8.5.86, 9.0.72

How to fix

Upgrade to a fixed version: Apache Tomcat 10.1.6, 8.5.86, 9.0.72. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-28708 or the next vulnerability affects your stack