Home > Vulnerability Database > CVE-2008-0128

Mend.io Vulnerability Database

CVE-2008-0128

Date: January 22, 2008

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

Severity Score

5.3

Related Resources (24)

Url: http://secunia.com/advisories/29242

Url: http://secunia.com/advisories/31493

Url: http://issues.apache.org/bugzilla/show_bug.cgi?id=41217

Url: http://secunia.com/advisories/33668

Url: https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E

Url: http://www.vupen.com/english/advisories/2009/0233

Url: http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html

Url: http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540

Url: http://www.securityfocus.com/archive/1/500412/100/0/threaded

Url: http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx

Url: http://security-tracker.debian.net/tracker/CVE-2008-0128

Url: http://rhn.redhat.com/errata/RHSA-2008-0630.html

Url: http://www.debian.org/security/2008/dsa-1468

Url: http://www.vupen.com/english/advisories/2008/0192

Url: https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E

Url: http://www.securityfocus.com/archive/1/500396/100/0/threaded

Url: http://secunia.com/advisories/28549

Url: http://www.securityfocus.com/bid/27365

Url: http://secunia.com/advisories/28552

Url: http://www.redhat.com/support/errata/RHSA-2008-0261.html

Url: https://nvd.nist.gov/vuln/detail/CVE-2008-0128

Url: https://exchange.xforce.ibmcloud.com/vulnerabilities/39804

Url: https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E

Url: https://www.mend.io/vulnerability-database/CVE-2008-0128

Severity Score

5.3

Weakness Type (CWE)

Configuration

CWE-16

CVSS v3.1

Base Score:	5.3
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	NONE
Availability (A):	NONE

CVSS v2

Base Score:	5.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	NONE
Availability (A):	NONE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2008-0128

Date: January 22, 2008

Severity Score

Related Resources (24)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?