Home > Vulnerability Database > CVE-2007-3382

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2007-3382

Date: August 14, 2007

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.

Severity Score

1.2

Related Resources (50)

Url: http://support.apple.com/kb/HT2163

Url: https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2007-3382

Url: http://www.vupen.com/english/advisories/2007/2902

Url: http://secunia.com/advisories/27037

Url: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11269

Url: http://secunia.com/advisories/26466

Url: http://www-01.ibm.com/support/docview.wss?uid=swg1IZ55562

Url: http://www.vupen.com/english/advisories/2009/0233

Url: http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540

Url: http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx

Url: http://secunia.com/advisories/27727

Url: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795

Url: https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E

Url: http://www.debian.org/security/2008/dsa-1453

Url: http://secunia.com/advisories/30802

Url: http://www.mandriva.com/security/advisories?name=MDKSA-2007:241

Url: http://www.redhat.com/support/errata/RHSA-2008-0195.html

Url: http://secunia.com/advisories/29242

Url: http://secunia.com/advisories/33668

Url: https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E

Url: http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html

Url: http://securitytracker.com/id?1018556

Url: http://www.vupen.com/english/advisories/2007/3386

Url: http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html

Url: http://www.debian.org/security/2008/dsa-1447

Url: http://www.vupen.com/english/advisories/2008/1981/references

Url: https://exchange.xforce.ibmcloud.com/vulnerabilities/36006

Url: http://www.redhat.com/support/errata/RHSA-2007-0950.html

Url: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01192554

Url: https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E

Url: http://www.securityfocus.com/archive/1/476466/100/0/threaded

Url: http://secunia.com/advisories/28361

Url: http://www.securityfocus.com/bid/25316

Url: http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html

Url: http://secunia.com/advisories/36486

Url: http://www.securityfocus.com/archive/1/500412/100/0/threaded

Url: http://www.kb.cert.org/vuls/id/993544

Url: https://access.redhat.com/security/cve/CVE-2007-3382

Url: http://www.vupen.com/english/advisories/2007/3527

Url: http://www.securityfocus.com/archive/1/500396/100/0/threaded

Url: http://tomcat.apache.org/security-6.html

Url: http://secunia.com/advisories/27267

Url: http://secunia.com/advisories/28317

Url: http://secunia.com/advisories/26898

Url: http://www.redhat.com/support/errata/RHSA-2008-0261.html

Url: https://nvd.nist.gov/vuln/detail/CVE-2007-3382

Url: http://www.redhat.com/support/errata/RHSA-2007-0871.html

Url: http://www.securityfocus.com/archive/1/476442/100/0/threaded

Url: https://www.mend.io/vulnerability-database/CVE-2007-3382

Severity Score

1.2

Weakness Type (CWE)

Information Leak / Disclosure

CWE-200

CVSS v3

Base Score:	1.2
Attack Vector (AV):
Attack Complexity (AC):
Privileges Required (PR):
User Interaction (UI):
Scope (S):
Confidentiality (C):	PARTIAL
Integrity (I):	NONE
Availability (A):	NONE

CVSS v2

Base Score:	5.3
Access Vector (AV):
Access Complexity (AC):
Authentication (AU):
Confidentiality (C):	LOW
Integrity (I):	NONE
Availability (A):	NONE
Additional information:

Do you need more information?

Contact Us