Description
Fixed in Apache Tomcat 6.0.9:
-
moderate: Session hi-jacking CVE-2008-0128
When using the SingleSignOn Valve via https the Cookie JSESSIONIDSSO is transmitted without the "secure" attribute, resulting in it being transmitted to any content that is - by purpose or error - requested via http from the same server.
Affected Apache Tomcat version (6.0.0 - 6.0.8).
Remediation
Upgrade Apache Tomcat to the latest version.
References
Related Vulnerabilities
Oracle Database Server CVE-2006-3698 Vulnerability (CVE-2006-3698)
SharePoint Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-3895)
Drupal Core 6.x Multiple Vulnerabilities (6.0 - 6.2)
WordPress Plugin iThemes Security (formerly Better WP Security) Security Bypass (7.9.0)
WordPress Plugin Photo Gallery, Images, Slider in Rbs Image Gallery Security Bypass (2.0.15)