GitHub Advisoryadvisory · Maven
GHSA-pvjh-7h8q-q56r Apache Tomcat has cookies without HTTPOnly flag in Set-Cookie header
MEDIUM
Official page ↗
- Aliases
- CVE-2010-4312
- Ecosystem
- Maven
- Packages
- org.apache.tomcat:tomcat
- Severity
- Moderate
- Weaknesses
- CWE-1004
- Reviewed
- 2024-02-07
Affected packages
• Maven org.apache.tomcat:tomcat: >= 6.0.0, < 6.0.35 → fixed in 6.0.35
Description
The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.
Related
Alias · CVE (1)
- CVE-2010-4312 The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote… vulnerability
Weakness · CWE (1)
- CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2010-4312 advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=608286 web
- https://github.com/apache/tomcat package
- https://launchpad.net/bugs/cve/CVE-2010-4312 web
- https://security-tracker.debian.org/tracker/CVE-2010-4312 web
- https://ubuntu.com/security/CVE-2010-4312 web