CVEvulnerability

CVE-2008-0128

5.0 MEDIUM Published 2008-01-23 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-01-23
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-16

Description

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

Affected configurations

• apache tomcat (<= 5.5.20)

Related

Weakness · not in database (1)

Referenced by CWE · observed example (1)

  • CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute weakness

References