| Vulnerability Name: | CVE-2010-4312 (CCN-63477) |
| Assigned: | 2010-11-22 |
| Published: | 2010-11-22 |
| Updated: | 2018-10-10 |
| Summary: | The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.
|
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)| Exploitability Metrics: | Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): None
Integrity (I): Low
Availibility (A): None |
|
| CVSS v2 Severity: | 6.4 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P)
4.7 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P/E:U/RL:OF/RC:C)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None | | Impact Metrics: | Confidentiality (C): None
Integrity (I): Partial
Availibility (A): Partial |
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
| | Impact Metrics: | Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None |
|
| Vulnerability Type: | CWE-16
|
| Vulnerability Consequences: | Gain Access |
| References: | Source: MITRE
Type: CNA
CVE-2010-4312
Source: CCN
Type: SA46776
Oracle Solaris Apache Tomcat Multiple Vulnerabilities
Source: CCN
Type: Apache Web Site
Apache Tomcat
Source: CCN
Type: OSVDB ID: 69512
Apache Tomcat Set-Cookie Header HTTPOnly Flag Session Hijacking Weakness
Source: BUGTRAQ
Type: UNKNOWN
20101122 [SECURITY] CVE-2010-4172: Apache Tomcat Manager application XSS vulnerability
Source: CCN
Type: Sun Product Security Blog, Nov 04, 2011
Multiple vulnerabilities in Apache Tomcat
Source: XF
Type: UNKNOWN
tomcat-httponly-session-hijacking(63477)
Source: CCN
Type: IBM Security Bulletin 6496741 (Sterling B2B Integrator)
Apache Log4j Vulnerabilities Affect IBM Sterling B2B Integrator
|
| Vulnerable Configuration: | Configuration 1:
cpe:/a:apache:tomcat:6.0:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.0:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.1:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.2:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.3:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.4:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.5:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.6:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.7:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.8:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.9:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.10:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.11:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.12:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.13:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.14:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.15:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.16:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.17:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.18:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.19:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.20:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.24:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.26:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.27:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.28:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.29:*:*:*:*:*:*:*
Configuration CCN 1:
cpe:/a:apache:tomcat:6.0.12:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.13:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.14:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.15:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.2:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.3:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.4:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.5:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.6:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.7:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.8:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.9:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.16:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.18:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.17:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.20:*:*:*:*:*:*:*OR cpe:/a:apache:tomcat:6.0.19:*:*:*:*:*:*:*AND cpe:/o:sun:sunos:5.9:*:*:*:*:*:*:*OR cpe:/o:sun:sunos:5.10:*:*:*:*:*:*:*OR cpe:/o:oracle:solaris:11_express:*:*:*:*:*:*:*OR cpe:/a:ibm:sterling_b2b_integrator:6.0.0.0:*:*:*:*:*:*:*OR cpe:/a:ibm:sterling_b2b_integrator:5.2.0.0:*:*:*:*:*:*:*
 Denotes that component is vulnerable |
| BACK |