Description

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

Remediation

References

CVE-2008-0128

Related Vulnerabilities

WordPress Plugin Related Posts Unspecified Vulnerability (5.12.69)

Apache Tomcat Deserialization of Untrusted Data Vulnerability (CVE-2021-25329)

WordPress Other Vulnerability (CVE-2005-1810)

Oracle JRE CVE-2013-2424 Vulnerability (CVE-2013-2424)

MySQL CVE-2019-2482 Vulnerability (CVE-2019-2482)

Severity

Medium

Classification

CVE-2008-0128

Tags

Missing Update Known Vulnerabilities