CVEvulnerability

CVE-2007-5333

5.0 MEDIUM Published 2008-02-12 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-02-12
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200

Description

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.

Affected configurations

• apache tomcat (>= 4.1.0 <= 4.1.36) • apache tomcat (>= 5.5.0 <= 5.5.25) • apache tomcat (>= 6.0.0 <= 6.0.14)

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References