Description

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

Remediation

References

CVE-2008-0128

Related Vulnerabilities

Jboss EAP Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-4572)

WordPress Plugin User Avatar Unspecified Vulnerability (1.4.6)

e107 Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-3731)

Drupal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-13688)

Ampache Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2024-51489)

Severity

Medium

Classification

CVE-2008-0128

Tags

Missing Update Known Vulnerabilities