CVE-2007-3385
Apache Tomcat 3.3-6.0.13 - Exposure of Sensitive Information via Cookie Value Handling
Title source: llmDescription
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.
References (51)
Core 51
Core References
Vendor Advisory vendor-advisory
x_refsource_fedora
https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9549
Mailing List mailing-list
x_refsource_mlist
https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
Mailing List mailing-list
x_refsource_mlist
https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E
Mailing List mailing-list
x_refsource_mlist
https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2008/dsa-1453
Vendor Advisory vendor-advisory
x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2007-0950.html
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT2163
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2008/1981/references
Third Party Advisory third-party-advisory
x_refsource_sreason
http://securityreason.com/securityalert/3011
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/27267
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/29242
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2007/3527
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/26466
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/500412/100/0/threaded
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33668
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2007/2902
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/500396/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/35999
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/26898
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/28361
Various Sources vendor-advisory
x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IZ55562
Vendor Advisory vendor-advisory
x_refsource_hp
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01192554
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/44183
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/28317
Mailing List vendor-advisory
x_refsource_apple
http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2009/0233
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
Various Sources x_refsource_confirm
http://tomcat.apache.org/security-6.html
Vendor Advisory vendor-advisory
x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2007-0871.html
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2007/3386
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/30802
Vendor Advisory vendor-advisory
x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2008-0195.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/27037
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://securitytracker.com/id?1018557
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/25316
Patch, US Government Resource third-party-advisory
x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/993544
Vendor Advisory vendor-advisory
x_refsource_hp
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/27727
Vendor Advisory vendor-advisory
x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2008-0261.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/36486
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2008/dsa-1447
Various Sources x_refsource_confirm
http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
Various Sources x_refsource_confirm
http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/476444/100/0/threaded
Vendor Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2007:241
Mailing List mailing-list
x_refsource_mlist
https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E
Mailing List mailing-list
x_refsource_mlist
https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E
Mailing List mailing-list
x_refsource_mlist
https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E
Mailing List mailing-list
x_refsource_mlist
https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E
Scores
EPSS
0.1694
EPSS Percentile
96.7%
Details
CWE
CWE-200
Status
published
Products (49)
apache/tomcat
3.3
apache/tomcat
3.3.1
apache/tomcat
3.3.1a
apache/tomcat
3.3.2
apache/tomcat
4.1.0
apache/tomcat
4.1.1
apache/tomcat
4.1.2
apache/tomcat
4.1.3 (2 CPE variants)
apache/tomcat
4.1.9 beta
apache/tomcat
4.1.10
... and 39 more
Published
Aug 14, 2007
Tracked Since
Feb 18, 2026