CVE-2007-3382

Apache Tomcat - Information Disclosure

Title source: rule

Description

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Tomasz Kuczynski · textremotemultiple
https://www.exploit-db.com/exploits/30496

References (46)

... and 26 more

Scores

EPSS 0.8391
EPSS Percentile 99.3%

Details

CWE
CWE-200
Status published
Products (49)
apache/tomcat 3.3
apache/tomcat 3.3.1
apache/tomcat 3.3.1a
apache/tomcat 3.3.2
apache/tomcat 4.1.0
apache/tomcat 4.1.1
apache/tomcat 4.1.2
apache/tomcat 4.1.3 (2 CPE variants)
apache/tomcat 4.1.9 beta
apache/tomcat 4.1.10
... and 39 more
Published Aug 14, 2007
Tracked Since Feb 18, 2026