CVE-2007-3385
apache tomcat: no CVSS score yet. EPSS 17% chance of exploitation in the next 30 days.
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.
- EPSS
- 17% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:tomcat
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-6j8f-66vh-39mj | Maven | org.apache.tomcat:tomcat | >=6.0.0 <=6.0.13 | no fix published |
| GHSA-6j8f-66vh-39mj | Maven | org.apache.tomcat:tomcat | >=5.5.0 <=5.5.24 | no fix published |
| GHSA-6j8f-66vh-39mj | Maven | org.apache.tomcat:tomcat | >=5.0.0 <=5.0.30 | no fix published |
| GHSA-6j8f-66vh-39mj | Maven | org.apache.tomcat:tomcat | >=4.1.0 <=4.1.36 | no fix published |
| GHSA-6j8f-66vh-39mj | Maven | org.apache.tomcat:tomcat | >=3.3.0 <=3.3.2 | no fix published |
References
- http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01192554
- http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html