CVE-2010-4312: Apache Tomcat has cookies without HTTPOnly flag in Set-Cookie header

May 14, 2022 (updated February 7, 2024)

The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.

References

bugs.debian.org/cgi-bin/bugreport.cgi?bug=608286
github.com/advisories/GHSA-pvjh-7h8q-q56r
launchpad.net/bugs/cve/CVE-2010-4312
nvd.nist.gov/vuln/detail/CVE-2010-4312
security-tracker.debian.org/tracker/CVE-2010-4312
ubuntu.com/security/CVE-2010-4312

Code Behaviors & Features

Detect and mitigate CVE-2010-4312 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →