CVE-2007-3382: Infoleak
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.
Other sources
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes (') as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-3382?
CVE-2007-3382 is considered to have a medium severity, as it can lead to session hijacking attacks.
How do I fix CVE-2007-3382?
To fix CVE-2007-3382, upgrade Apache Tomcat to version 6.0.14 or later, or to version 5.5.25 or later.
What versions of Apache Tomcat are affected by CVE-2007-3382?
CVE-2007-3382 affects Apache Tomcat versions from 3.3 to 6.0.13.
What type of exploitation is associated with CVE-2007-3382?
CVE-2007-3382 can be exploited by remote attackers to leak sensitive information such as session IDs.
Are there any known workarounds for CVE-2007-3382?
There are no specific workarounds for CVE-2007-3382 other than upgrading to secure versions of Apache Tomcat.