CVE-2008-0128
Publicada el · Actualizada el
8Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 20%
probabilidad de explotación
20%top 3% de las CVE
explotación observada
noninguna fuente lo reporta
The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
Productos afectados
n/a · n/aReferencias
http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspxhttp://issues.apache.org/bugzilla/show_bug.cgi?id=41217http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.htmlhttp://rhn.redhat.com/errata/RHSA-2008-0630.htmlhttp://secunia.com/advisories/28549http://secunia.com/advisories/28552http://secunia.com/advisories/29242http://secunia.com/advisories/31493http://secunia.com/advisories/33668http://security-tracker.debian.net/tracker/CVE-2008-0128https://exchange.xforce.ibmcloud.com/vulnerabilities/39804https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E