Information Exposure Affecting tomcat:catalina package, versions [4.1.0, 5.0.16)
Snyk CVSS
Attack Complexity
Low
Threat Intelligence
EPSS
0.18% (55th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-TOMCAT-472581
- published 26 Nov 2019
- disclosed 22 Jan 2007
- credit Unknown
Introduced: 22 Jan 2007
CVE-2008-0128 Open this link in a new tabHow to fix?
Upgrade tomcat:catalina to version 5.0.16 or higher.
Overview
tomcat:catalina is a library that contains Tomcat Servlet Engine Core Classes and Standard implementations.
Affected versions of this package are vulnerable to Information Exposure. When using the SingleSignOn Valve via https, the Cookie JSESSIONIDSSO is transmitted without the secure attribute, resulting in it being transmitted to any concurrent request that is sent via HTTP.