CVE-2007-3385: Infoleak
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.
Other sources
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-3385?
CVE-2007-3385 is categorized as a medium severity vulnerability due to the risk of session hijacking.
How do I fix CVE-2007-3385?
To fix CVE-2007-3385, upgrade to a later version of Apache Tomcat than those listed as affected.
What versions of Apache Tomcat are affected by CVE-2007-3385?
Versions of Apache Tomcat from 3.3 to 6.0.13 are affected by CVE-2007-3385.
What type of attack can CVE-2007-3385 facilitate?
CVE-2007-3385 can facilitate session hijacking attacks by potentially leaking sensitive cookie information.
Is CVE-2007-3385 a common vulnerability?
CVE-2007-3385 is a known vulnerability in older versions of Apache Tomcat and has been discussed in various security advisories.