Database Management

Database Performance Analyzer is not affected by CVE-2023-28708 and CVE-2023-41080

This article explains why CVE-2023-28708 and CVE-2023-41080 do not affect DPA.

First published date

1/10/2024 12:56 AM

Last published date

1/6/2025 9:59 PM

Overview

In November of 2023, the National Institute of Standards and Technology (NIST) updated the following security bulletins about vulnerabilities that affect Tomcat versions 8.5.85, 8.5.86, and 8.5.93:

  • CVE-2023-28708 

    When the RemoteIpFilter is used with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to HTTPS, session cookies created by Apache Tomcat do not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.

  • CVE-2023-41080 

    URL Redirection to an untrusted site ('Open Redirect') is possible with the FORM authentication feature of Apache Tomcat. The vulnerability is limited to the ROOT (default) web application.

Note: See also Database Performance Analyzer (DPA) and a potential denial of service attack: CVE-2023-24998 and CVE-2023-28709.

Product section

Database Performance Analyzer

Cause

CVE-2023-28708 and CVE-2023-41080

Resolution

Some supported versions of DPA include an affected version of Apache Tomcat. However, these vulnerabilities do not apply to DPA.

  • DPA is not affected by CVE-2023-28708 because it does not use the RemoteIpFilter in the configuration described above.

  • DPA is not affected by CVE-2023-41080 because it does not use the FORM authentication feature of Apache Tomcat. DPA uses Spring Security, which does not include this vulnerability.