NVD

Id
118  
Name
CVE-2008-0128  
Description
The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-03  
Published
2008-01-22  
Modified Date
2011-03-07  
Seq
2008-0128  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
1095 118 CVE-2008-0128 http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx  View
1096 118 CVE-2008-0128 http://issues.apache.org/bugzilla/show_bug.cgi?id=41217  View
1097 118 CVE-2008-0128 SUSE-SR:2008:005  View
1098 118 CVE-2008-0128 RHSA-2008:0630  View
1099 118 CVE-2008-0128 http://security-tracker.debian.net/tracker/CVE-2008-0128  View
1100 118 CVE-2008-0128 http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540  View
1101 118 CVE-2008-0128 RHSA-2008:0261  View
1102 118 CVE-2008-0128 20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities  View
1103 118 CVE-2008-0128 20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)  View
1104 118 CVE-2008-0128 27365  View
1105 118 CVE-2008-0128 ADV-2008-0192  View
1106 118 CVE-2008-0128 ADV-2009-0233  View
1107 118 CVE-2008-0128 apache-singlesignon-information-disclosure(39804)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
45857 JVNDB-2008-001167 Apache Tomcat JSESSIONIDSSO クッキーの不適切な設定の問題 Apache Tomcat の SingleSignOn 値 (org.apache.catalina.authenticator.SingleSignOn) において、https セッションの JSESSIONIDSSO クッキーの secure フラグを設定しないため、http リクエストを送信する際に、SingleSignOn 用のクッキーを使用する問題が存在します。 CVE-2008-0128 30241 CVE-2008-0128 118 5 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-001167.html 2008-01-22 2009-10-20 View