GitHub Advisoryadvisory · Maven

GHSA-6j8f-66vh-39mj Apache Tomcat Mishandles Character Sequence in Cookies

MEDIUM Published 2022-05-01 Modified 2025-04-09 Official page ↗
Aliases
CVE-2007-3385
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2023-09-22

Affected packages

• Maven org.apache.tomcat:tomcat: >= 6.0.0, <= 6.0.13 (no fix yet) • Maven org.apache.tomcat:tomcat: >= 5.5.0, <= 5.5.24 (no fix yet) • Maven org.apache.tomcat:tomcat: >= 5.0.0, <= 5.0.30 (no fix yet) • Maven org.apache.tomcat:tomcat: >= 4.1.0, <= 4.1.36 (no fix yet) • Maven org.apache.tomcat:tomcat: >= 3.3.0, <= 3.3.2 (no fix yet)

Description

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the `\"` character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.

Related

Alias · CVE (1)

  • CVE-2007-3385 Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \"… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References