CVE-2007-3382
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.
- EPSS
- 37% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:tomcat
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qff8-g48j-pwpw | Maven | org.apache.tomcat:tomcat | >=6.0.0 <=6.0.13 | no fix published |
| GHSA-qff8-g48j-pwpw | Maven | org.apache.tomcat:tomcat | >=5.5.0 <=5.5.24 | no fix published |
| GHSA-qff8-g48j-pwpw | Maven | org.apache.tomcat:tomcat | >=5.0.0 <=5.0.30 | no fix published |
| GHSA-qff8-g48j-pwpw | Maven | org.apache.tomcat:tomcat | >=4.1.0 <=4.1.36 | no fix published |
| GHSA-qff8-g48j-pwpw | Maven | org.apache.tomcat:tomcat | >=3.3.0 <=3.3.2 | no fix published |
References
- http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01192554
- http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html