GitHub Advisoryadvisory · Maven

GHSA-qff8-g48j-pwpw Apache Tomcat treats single quotes as delimiters in cookies

MEDIUM Published 2022-05-01 Modified 2023-09-22 Official page ↗
Aliases
CVE-2007-3382
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2023-09-22

Affected packages

• Maven org.apache.tomcat:tomcat: >= 6.0.0, <= 6.0.13 (no fix yet) • Maven org.apache.tomcat:tomcat: >= 5.5.0, <= 5.5.24 (no fix yet) • Maven org.apache.tomcat:tomcat: >= 5.0.0, <= 5.0.30 (no fix yet) • Maven org.apache.tomcat:tomcat: >= 4.1.0, <= 4.1.36 (no fix yet) • Maven org.apache.tomcat:tomcat: >= 3.3.0, <= 3.3.2 (no fix yet)

Description

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes (`'`) as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.

Related

Alias · CVE (1)

  • CVE-2007-3382 Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References