CVE-2008-0128: Medium severity tomcat vulnerability
The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-0128?
CVE-2008-0128 is considered a medium severity vulnerability due to the potential for cookie interception.
How do I fix CVE-2008-0128?
To fix CVE-2008-0128, upgrade Apache Tomcat to version 5.5.21 or later where the issue is resolved.
What impact does CVE-2008-0128 have on web applications?
CVE-2008-0128 can expose applications to session hijacking if the JSESSIONIDSSO cookie is transmitted over insecure HTTP.
Is CVE-2008-0128 present in all versions of Apache Tomcat?
CVE-2008-0128 affects all versions of Apache Tomcat before 5.5.21.
How does CVE-2008-0128 affect the secure flag of cookies?
CVE-2008-0128 fails to set the secure flag on the JSESSIONIDSSO cookie in HTTPS sessions, allowing it to be sent over HTTP.