GHSA-pvjh-7h8q-q56r
Apache Tomcat has cookies without HTTPOnly flag in Set-Cookie header
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 6.0.0, < 6.0.35 | 6.0.35 |
Details
As written in the advisory (Markdown source, shown as plain text).
The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.
References
External links from the advisory. They lead to third-party sites.