Description
The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.
References (1)
Core 1
Core References
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/514866/100/0/threaded
Scores
EPSS
0.0214
EPSS Percentile
80.0%
Details
CWE
CWE-16
Status
published
Products (28)
apache/tomcat
6.0
apache/tomcat
6.0.0
apache/tomcat
6.0.1
apache/tomcat
6.0.2
apache/tomcat
6.0.3
apache/tomcat
6.0.4
apache/tomcat
6.0.5
apache/tomcat
6.0.6
apache/tomcat
6.0.7
apache/tomcat
6.0.8
... and 18 more
Published
Nov 26, 2010
Tracked Since
Feb 18, 2026