CVE-2023-28708
Apache Tomcat 8.5.0 – 8.5.86
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-28708 is a medium-severity Unprotected Transport of Credentials (CWE-523) vulnerability in Apache Tomcat. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Proc Filesystem (T1003.007); ranked in the top 22% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-0829
Vulnerability Data
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85…
more
did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 5 hardening rules · 3 OS baselines
—
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Using a distinct channel for credential transmission prevents unprotected transport over the application's normal communication path.
Requiring protected transport for credentials directly mitigates unprotected credential transmission over networks.
Prevents unprotected transport of credentials by mandating confidentiality mechanisms such as TLS for all sensitive data flows.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requires secure information transfer, which can include protecting credentials in transit.
Addresses management of authentication information, indirectly supporting protection during transmission.
Requires network security controls that can protect credential transmission.
A.8.21 mandates identifying/implementing network service security features including authentication, encryption, and connection controls plus rules on allowed networks, authentication requirements, and monitoring; this directly stops in-transit credential exposure for most network-based logins (e.g. via mandated TLS), with a bounded remainder of non-network or non-service-mediated credential flows.
Requires use of cryptography, directly enabling encryption of credentials in transit.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
RHEL 8 (2 rules)
- V-230487 RHEL 8 must not have the telnet-server package installed. blocks CWE-523
- V-230492 RHEL 8 must not have the rsh-server package installed. blocks CWE-523