title: Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations
description:
When using the RemoteIpFilter with requests received from a    reverse proxy via HTTP that include the X-Forwarded-Proto    header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.
problem types: CWE-523 Unprotected Transport of Credentials
affected:
{
defaultStatus: unaffected
product: Apache Tomcat
vendor: Apache Software Foundation
versions:
lessThanOrEqual: 11.0.0-M2, status: affected, version: 11.0.0-M1, versionType: semver
lessThanOrEqual: 10.1.5, status: affected, version: 10.1.0-M1, versionType: semver
lessThanOrEqual: 9.0.71, status: affected, version: 9.0.0-M1, versionType: semver
lessThanOrEqual: 8.5.85, status: affected, version: 8.5.0, versionType: semver
}
metrics:
other: [
content: {'text': 'important'}
type: Textual description of severity
]