CVE-2010-4312

EUVD-2022-4827
The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.4 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 82%
Affected Products (NVD)
VendorProductVersion
apachetomcat
6.0
apachetomcat
6.0.0
apachetomcat
6.0.1
apachetomcat
6.0.2
apachetomcat
6.0.3
apachetomcat
6.0.4
apachetomcat
6.0.5
apachetomcat
6.0.6
apachetomcat
6.0.7
apachetomcat
6.0.8
apachetomcat
6.0.9
apachetomcat
6.0.10
apachetomcat
6.0.11
apachetomcat
6.0.12
apachetomcat
6.0.13
apachetomcat
6.0.14
apachetomcat
6.0.15
apachetomcat
6.0.16
apachetomcat
6.0.17
apachetomcat
6.0.18
apachetomcat
6.0.19
apachetomcat
6.0.20
apachetomcat
6.0.24
apachetomcat
6.0.26
apachetomcat
6.0.27
apachetomcat
6.0.28
apachetomcat
6.0.29
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
tomcat5
dapper
ignored
hardy
dne
karmic
dne
lucid
dne
maverick
dne
tomcat5.5
dapper
dne
hardy
ignored
karmic
dne
lucid
dne
maverick
dne
tomcat6
dapper
dne
hardy
dne
karmic
ignored
lucid
ignored
maverick
ignored
Common Weakness Enumeration
References
http://www.securityfocus.com/archive/1/514866/100/0/threaded
http://www.securityfocus.com/archive/1/514866/100/0/threaded