Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveRedhatCVE-2007-5333
HistoryFeb 12, 2008 - 1:00 a.m.

CVE-2007-5333

2008-02-1201:00:00
CWE-200
redhat
web.nvd.nist.gov
110
apache tomcat
cve-2007-5333
cookie
session hijacking
information leakage

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

4.7

Confidence

High

EPSS

0.125

Percentile

95.6%

JSON

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.

Affected configurations

Nvd
Node
apachetomcatRange4.1.0–4.1.36
OR
apachetomcatRange5.5.0–5.5.25
OR
apachetomcatRange6.0.0–6.0.14
VendorProductVersionCPE
apachetomcat*cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

References

Related

jvn 1
cvelist 2
ubuntucve 2
osv 4
nvd 2
github 2
exploitdb 1
veracode 3
prion 2
nessus 41
openvas 49
tomcat 5
exploitpack 1
redhat 12
cve 1
seebug 2
securityvulns 5
gentoo 1
oraclelinux 2
centos 2
fedora 5
debian 2
atlassian 2
altlinux 1
vmware 4
ibm 1
jvn
jvn
JVN#09470767 Apache Tomcat fails to properly handle cookie value
2008-02-12 00:00:00
cvelist
cvelist
CVE-2007-5333
2008-02-12 00:00:00
CVE-2007-3385
2007-08-14 22:00:00
ubuntucve
ubuntucve
CVE-2007-5333
2008-02-12 00:00:00
CVE-2007-3385
2007-08-14 00:00:00
osv
osv
Exposure of Sensitive Information in Apache Tomcat
2022-05-01 18:32:19
Apache Tomcat Mishandles Character Sequence in Cookies
2022-05-01 18:13:14
tomcat5 - several vulnerabilities
2008-01-07 00:00:00
nvd
nvd
CVE-2007-5333
2008-02-12 01:00:00
CVE-2007-3385
2007-08-14 22:17:00
github
github
Exposure of Sensitive Information in Apache Tomcat
2022-05-01 18:32:19
Apache Tomcat Mishandles Character Sequence in Cookies
2022-05-01 18:13:14
exploitdb
exploitdb
Apache Tomcat 6.0.15 - Cookie Quote Handling Remote Information Disclosure
2008-02-09 00:00:00
veracode
veracode
Session Hijacking
2018-11-12 08:37:47
Information Disclosure
2019-03-25 08:40:44
Session Hijacking
2018-11-13 05:10:16
prion
prion
Code injection
2008-02-12 01:00:00
Design/Logic Flaw
2007-08-14 22:17:00
nessus
nessus
Mandriva Linux Security Advisory : tomcat5 (MDVSA-2009:018)
2009-04-23 00:00:00
Apache Tomcat < 5.5.26 Multiple Vulnerabilities
2010-07-01 00:00:00
Apache Tomcat 6.0.x < 6.0.16 Information Disclosure
2008-02-08 00:00:00
openvas
openvas
Mandrake Security Advisory MDVSA-2009:018 (tomcat5)
2009-01-20 00:00:00
Mandrake Security Advisory MDVSA-2009:018 (tomcat5)
2009-01-20 00:00:00
Gentoo Security Advisory GLSA 200804-10 (tomcat)
2008-09-24 00:00:00
tomcat
tomcat
Fixed in Apache Tomcat 5.5.26
2008-02-05 00:00:00
Fixed in Apache Tomcat 6.0.16
2008-02-08 00:00:00
Fixed in Apache Tomcat 4.1.37
2005-10-06 00:00:00
exploitpack
exploitpack
Apache Tomcat 6.0.15 - Cookie Quote Handling Remote Information Disclosure
2008-02-09 00:00:00
redhat
redhat
(RHSA-2009:1454) Important: tomcat5 security update
2009-09-21 00:00:00
(RHSA-2009:1616) Low: tomcat security update for Red Hat Network Satellite Server
2009-11-30 00:00:00
(RHSA-2009:1563) Important: tomcat security update
2009-11-09 00:00:00
cve
cve
CVE-2007-3385
2007-08-14 22:17:00
seebug
seebug
Apache Tomcat <= 6.0.15 Cookie Quote Handling Remote Information Disclosure Vulnerability
2014-07-01 00:00:00
Apache Tomcat倚δΈͺθΏœη¨‹δΏ‘ζ―ζ³„ιœ²ζΌζ΄ž
2007-08-23 00:00:00
securityvulns
securityvulns
CVE-2007-3385: Handling of &#92;&quot; in cookies
2007-08-14 00:00:00
Apache Tomcat multiple security vulnerabilities
2007-08-14 00:00:00
HP Network Node Manager multiple security vulnerabilities
2013-07-29 00:00:00
gentoo
gentoo
Tomcat: Multiple vulnerabilities
2008-04-10 00:00:00
oraclelinux
oraclelinux
tomcat security update
2009-07-21 00:00:00
Moderate: tomcat security update
2007-09-26 00:00:00
centos
centos
tomcat5 security update
2009-07-29 17:30:22
tomcat5 security update
2007-09-28 08:11:50
fedora
fedora
[SECURITY] Fedora 8 Update: tomcat5-5.5.26-1jpp.2.fc8
2008-02-13 05:14:35
[SECURITY] Fedora 7 Update: tomcat5-5.5.26-1jpp.2.fc7
2008-02-13 04:55:03
[SECURITY] Fedora 8 Update: tomcat5-5.5.27-0jpp.2.fc8
2008-09-16 23:28:35
debian
debian
[SECURITY] [DSA 1453-1] New tomcat5 packages fix several vulnerabilities
2008-01-07 18:41:20
[SECURITY] [DSA 1447-1] New tomcat5.5 packages fix several vulnerabilities
2008-01-03 21:54:49
atlassian
atlassian
Upgrade standalone Tomcat to 5.5.25
2008-01-15 04:23:59
Upgrade standalone Tomcat to 5.5.25
2008-01-15 04:23:59
altlinux
altlinux
Security fix for the ALT Linux 5 package tomcat5 version 0:5.5.25-alt1_1.1jpp5.0
2007-11-30 00:00:00
vmware
vmware
Updated Tomcat and Java JRE packages for VMware ESX 3.5 and VirtualCenter
2008-06-16 00:00:00
Updated Tomcat and Java JRE packages for VMware ESX 3.5 and VirtualCenter
2008-06-16 00:00:00
VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components
2009-11-20 00:00:00
ibm
ibm
Security Bulletin: TADDM affected by multiple vulnerabilities due to Apache Tomcat libraries
2023-01-27 10:54:22

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

4.7

Confidence

High

EPSS

0.125

Percentile

95.6%

JSON
Related for CVE-2007-5333
jvn1cvelist2ubuntucve2osv4nvd2github2exploitdb1veracode3prion2nessus41openvas49tomcat5exploitpack1redhat12cve1seebug2securityvulns5gentoo1oraclelinux2centos2fedora5debian2atlassian2altlinux1vmware4ibm1