CVE-2010-4312: Medium severity tomcat vulnerability
Published Nov 26, 2010
·Updated
The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.
Affected Software
29 affected componentsFixes available
maven/org.apache.tomcat:tomcat>=6.0.0<6.0.35
6.0.35
debian/tomcat6
Apache Tomcat=6.0.6
Apache Tomcat=6.0.11
Apache Tomcat=6.0.7
Apache Tomcat=6.0.4
Apache Tomcat=6.0.15
Apache Tomcat=6.0.20
Apache Tomcat=6.0.10
Apache Tomcat=6.0.29
Apache Tomcat=6.0.3
Apache Tomcat=6.0.9
Apache Tomcat=6.0.24
Apache Tomcat=6.0.17
Apache Tomcat=6.0
Apache Tomcat=6.0.28
Apache Tomcat=6.0.0
Apache Tomcat=6.0.14
Apache Tomcat=6.0.1
Apache Tomcat=6.0.12
Apache Tomcat=6.0.18
Apache Tomcat=6.0.5
Apache Tomcat=6.0.2
Apache Tomcat=6.0.13
Apache Tomcat=6.0.26
Apache Tomcat=6.0.19
Apache Tomcat=6.0.27
Apache Tomcat=6.0.16
Apache Tomcat=6.0.8
Event History
Nov 26, 2010
CVE Published
via Ubuntu·12:00 AM
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Dec 29, 2010
Data Sourced
via Debian·05:33 PM
SeverityAffected Software
May 14, 2022
Advisory Published
via GitHub·02:42 AM
Feb 7, 2024
Data Sourced
via Launchpad·11:56 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2010-4312?
CVE-2010-4312 is considered a medium severity vulnerability.
2
How do I fix CVE-2010-4312?
To fix CVE-2010-4312, upgrade to Apache Tomcat version 6.0.35 or later.
3
What versions of Apache Tomcat are affected by CVE-2010-4312?
CVE-2010-4312 affects multiple versions of Apache Tomcat 6.x up to 6.0.34.
4
Who can be affected by CVE-2010-4312?
Users of Apache Tomcat who do not enable the HTTPOnly flag for their cookies may be vulnerable.
5
What is the impact of CVE-2010-4312?
The impact of CVE-2010-4312 is an increased risk of session hijacking through script access to cookies.